diff --git a/pkgs/besu/update.sh b/pkgs/besu/update.sh
new file mode 100644
index 00000000..a53f4933
--- /dev/null
+++ b/pkgs/besu/update.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix sd
+
+set -e
+
+dirname="$(dirname "$0")"
+rootDir="$(git -C "$dirname" rev-parse --show-toplevel)"
+pname="besu"
+
+updateVersion() {
+  local version=$1
+  sd "version = \"[0-9.]*\";" "version = \"$version\";" "${dirname}/default.nix"
+}
+
+updateHash() {
+  local version=$1
+  local url="https://hyperledger.jfrog.io/hyperledger/${pname}-binaries/${pname}/${version}/${pname}-${version}.tar.gz"
+  local sriHash=$(nix store prefetch-file --json "$url" | jq -r .hash)
+  sd 'hash = "[a-zA-Z0-9/+-=]*";' "hash = \"$sriHash\";" "${dirname}/default.nix"
+}
+
+currentVersion=$(nix derivation show "${rootDir}#${pname}" | jq -r '.[].env.version')
+latestVersion=$(curl -s "https://hyperledger.jfrog.io/artifactory/api/search/latestVersion?g=org.hyperledger.besu.internal&a=besu")
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+  echo "${pname} is up to date: ${currentVersion}"
+  exit 0
+fi
+
+echo "Updating ${pname} from ${currentVersion} to ${latestVersion}"
+
+updateVersion "$latestVersion"
+updateHash "$latestVersion"
diff --git a/pkgs/teku/default.nix b/pkgs/teku/default.nix
index a88fc8ae..2441b0b5 100644
--- a/pkgs/teku/default.nix
+++ b/pkgs/teku/default.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
     wrapProgram $out/bin/${pname} --set JAVA_HOME "${jre}"
   '';
 
+  passtrhu.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Java Implementation of the Ethereum 2.0 Beacon Chain";
     homepage = "https://github.com/ConsenSys/teku";
diff --git a/pkgs/teku/update.sh b/pkgs/teku/update.sh
new file mode 100644
index 00000000..d31d4cbf
--- /dev/null
+++ b/pkgs/teku/update.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix sd
+
+set -e
+
+dirname="$(dirname "$0")"
+rootDir="$(git -C "$dirname" rev-parse --show-toplevel)"
+pname="teku"
+
+updateVersion() {
+  local version=$1
+  sd "version = \"[0-9.]*\";" "version = \"$version\";" "${dirname}/default.nix"
+}
+
+updateHash() {
+  local version=$1
+  local url="https://artifacts.consensys.net/public/${pname}/raw/names/${pname}.tar.gz/versions/${version}/${pname}-${version}.tar.gz"
+
+  local output=$(nix store prefetch-file --json "$url")
+  local sriHash=$(echo "$output" | jq -r .hash)
+
+  sd "\"hash\" = \"[a-zA-Z0-9\/+-=]*\";" "\"hash\" = \"$sriHash\";" "${dirname}/default.nix"
+}
+
+currentVersion=$(nix show-derivation "${rootDir}#${pname}" | jq -r '.[].env.version')
+latestVersion=$(curl -s "https://api.github.com/repos/ConsenSys/teku/releases/latest" | jq -r '.tag_name')
+
+# Optionally strip leading 'v' if present in the tag name
+latestVersion=${latestVersion#v}
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+  echo "${pname} is up to date: ${currentVersion}"
+  exit 0
+fi
+
+echo "Updating ${pname} from ${currentVersion} to ${latestVersion}"
+
+updateVersion "$latestVersion"
+updateHash "$latestVersion"
+