diff --git a/pkgs/development/libraries/nss/3_114.nix b/pkgs/development/libraries/nss/3_114.nix
index 3d17c3de971c..af578ffeb2e4 100644
--- a/pkgs/development/libraries/nss/3_114.nix
+++ b/pkgs/development/libraries/nss/3_114.nix
@@ -1,4 +1,6 @@
 import ./generic.nix {
-  version = "3.114";
-  hash = "sha256-YVtXk1U9JtqfOH7+m/+bUI/yXJcydqjjGbCy/5xbMe8=";
+  version = "3.114.1";
+  hash = "sha256-xs7G5MHOd6mPVpBfDd2fFG2qw+5KypBTPqErbl0zfrk=";
+  filename = "3_114.nix";
+  versionRegex = "NSS_(3)_(114)(?:_(\\d+))?_RTM";
 }
diff --git a/pkgs/development/libraries/nss/esr.nix b/pkgs/development/libraries/nss/esr.nix
index f1b8c6df4acf..63b10c220152 100644
--- a/pkgs/development/libraries/nss/esr.nix
+++ b/pkgs/development/libraries/nss/esr.nix
@@ -1,4 +1,6 @@
 import ./generic.nix {
   version = "3.101.2";
   hash = "sha256-i5K47pzQYOiD4vFHBN6VeqXEdPBOM7U1oSK0qSi2M2Y=";
+  filename = "esr.nix";
+  versionRegex = "NSS_(3)_(101)(?:_(\\d+))?_RTM";
 }
diff --git a/pkgs/development/libraries/nss/generic.nix b/pkgs/development/libraries/nss/generic.nix
index 77d838a25ab0..6c274607e03c 100644
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@@ -1,4 +1,9 @@
-{ version, hash }:
+{
+  version,
+  hash,
+  filename,
+  versionRegex,
+}:
 {
   lib,
   stdenv,
@@ -19,6 +24,7 @@
   enableFIPS ? false,
   nixosTests,
   nss_latest,
+  nix-update-script,
 }:
 
 let
@@ -229,7 +235,14 @@ stdenv.mkDerivation rec {
       runHook postInstall
     '';
 
-  passthru.updateScript = ./update.sh;
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--override-filename"
+      "pkgs/development/libraries/nss/${filename}"
+      "--version-regex"
+      versionRegex
+    ];
+  };
 
   passthru.tests =
     lib.optionalAttrs (lib.versionOlder version nss_latest.version) {
diff --git a/pkgs/development/libraries/nss/latest.nix b/pkgs/development/libraries/nss/latest.nix
index 45cd7960539f..85caeb11d41c 100644
--- a/pkgs/development/libraries/nss/latest.nix
+++ b/pkgs/development/libraries/nss/latest.nix
@@ -5,6 +5,8 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.115";
-  hash = "sha256-8PeFeaIOtjBZJLBx3ONwZlK5SaLnjKEFoZWvVsu/3tA=";
+  version = "3.115.1";
+  hash = "sha256-SuXNqRW0lBPioYxmoGa3ZbfxC7ud6TW3xVpakVwtm14=";
+  filename = "latest.nix";
+  versionRegex = "NSS_(\\d+)_(\\d+)(?:_(\\d+))?_RTM";
 }
diff --git a/pkgs/development/libraries/nss/update.sh b/pkgs/development/libraries/nss/update.sh
deleted file mode 100755
index 600dbdff004c..000000000000
--- a/pkgs/development/libraries/nss/update.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnugrep gnused coreutils common-updater-scripts
-
-set -x
-
-base_url="https://ftp.mozilla.org/pub/security/nss/releases/"
-
-version="$(curl -sSL ${base_url}  | grep 'RTM' | grep -v WITH_CKBI | sed 's|.*>\(NSS_[0-9]*_[0-9]*_*[0-9]*_*[0-9]*_RTM\)/.*|\1|g' | sed 's|NSS_||g' | sed 's|_RTM||g' | sed 's|_|.|g' | sort -V | tail -1)"
-hash="$(nix-hash --type sha256 --base32 ${base_url}/NSS_${version/\./_}_RTM/src/nss-${version}.tar.gz)"
-update-source-version nss "${version}" "${hash}"