diff --git a/pkgs/by-name/li/librandombytes/package.nix b/pkgs/by-name/li/librandombytes/package.nix
index 5bb8175420de..e6ecbdef8eea 100644
--- a/pkgs/by-name/li/librandombytes/package.nix
+++ b/pkgs/by-name/li/librandombytes/package.nix
@@ -51,6 +51,8 @@ stdenv.mkDerivation (finalAttrs: {
     install_name_tool -change "librandombytes-kernel.1.dylib" "$out/lib/librandombytes-kernel.1.dylib" "$out/bin/randombytes-info"
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     homepage = "https://randombytes.cr.yp.to/";
     description = "A simple API for applications generating fresh randomness";
diff --git a/pkgs/by-name/li/librandombytes/update.sh b/pkgs/by-name/li/librandombytes/update.sh
new file mode 100755
index 000000000000..6a19e7b56525
--- /dev/null
+++ b/pkgs/by-name/li/librandombytes/update.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl cacert nix common-updater-scripts --pure
+#shellcheck shell=bash
+
+set -eu -o pipefail
+
+# upstream doesn't use git, but has this file specifically for versioning
+version="$(curl https://randombytes.cr.yp.to/librandombytes-latest-version.txt)"
+
+update-source-version librandombytes "$version"
+