diff --git a/pkgs/applications/blockchains/solana/default.nix b/pkgs/applications/blockchains/solana/default.nix
index 0eb48b19c88f..a91d1f390534 100644
--- a/pkgs/applications/blockchains/solana/default.nix
+++ b/pkgs/applications/blockchains/solana/default.nix
@@ -10,19 +10,23 @@
 , zlib
 , protobuf
 }:
+let
+  pinData = lib.importJSON ./pin.json;
+  version = pinData.version;
+  sha256 = pinData.sha256;
+  cargoSha256 = pinData.cargoSha256;
+in
 rustPlatform.buildRustPackage rec {
   pname = "solana-testnet-cli";
-  version = "1.9.2";
+  inherit version cargoSha256;
 
   src = fetchFromGitHub {
     owner = "solana-labs";
     repo = "solana";
     rev = "v${version}";
-    sha256 = "sha256-wrv35vBohLztMZPb6gfZdCaXcjj/Y7vnQqINaI6dBM4=";
+    inherit sha256;
   };
 
-  cargoSha256 = "sha256-A5uVa+cRmrkVyw7MFH4QAr0VIFi18wcc2VPFvQyT9EM=";
-
   buildAndTestSubdir = "cli";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ protobuf pkg-config ];
@@ -53,4 +57,5 @@ rustPlatform.buildRustPackage rec {
     maintainers = with maintainers; [ happysalada ];
     platforms = platforms.unix;
   };
+  passthru.updateScript = ./update.sh;
 }
diff --git a/pkgs/applications/blockchains/solana/pin.json b/pkgs/applications/blockchains/solana/pin.json
new file mode 100644
index 000000000000..34ef47979592
--- /dev/null
+++ b/pkgs/applications/blockchains/solana/pin.json
@@ -0,0 +1,5 @@
+{
+  "version": "1.10.9",
+  "sha256": "sha256-y7+ogMJ5E9E/+ZaTCHWOQWG7iR+BGuVqvlNUDT++Ghc=",
+  "cargoSha256": "sha256-7EULmmztt+INvSdluvvX5xbE2hWKAmHiW0MEYIPNPw4="
+}
diff --git a/pkgs/applications/blockchains/solana/update.sh b/pkgs/applications/blockchains/solana/update.sh
new file mode 100755
index 000000000000..ffd8b0010cc2
--- /dev/null
+++ b/pkgs/applications/blockchains/solana/update.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i oil -p jq sd nix-prefetch-github ripgrep
+
+# TODO set to `verbose` or `extdebug` once implemented in oil
+shopt --set xtrace
+# we need failures inside of command subs to get the correct cargoSha256
+shopt --unset inherit_errexit
+
+const directory = $(dirname $0 | xargs realpath)
+const owner = "solana-labs"
+const repo = "solana"
+const latest_rev = $(curl -q https://api.github.com/repos/${owner}/${repo}/releases/latest | \
+  jq -r '.tag_name')
+const latest_version = $(echo $latest_rev | sd 'v' '')
+const current_version = $(jq -r '.version' $directory/pin.json)
+if ("$latest_version" === "$current_version") {
+  echo "solana is already up-to-date"
+  return 0
+} else {
+  const tarball_meta = $(nix-prefetch-github $owner $repo --rev "$latest_rev")
+  const tarball_hash = "sha256-$(echo $tarball_meta | jq -r '.sha256')"
+
+  jq ".version = \"$latest_version\" | \
+      .\"sha256\" = \"$tarball_hash\" | \
+      .\"cargoSha256\" = \"\"" $directory/pin.json | sponge $directory/pin.json
+
+  const new_cargo_sha256 = $(nix-build -A solana-testnet 2>&1 | \
+    tail -n 2 | \
+    head -n 1 | \
+    sd '\s+got:\s+' '')
+
+  jq ".cargoSha256 = \"$new_cargo_sha256\"" $directory/pin.json | sponge $directory/pin.json
+}