diff --git a/pkgs/tools/networking/zrok/default.nix b/pkgs/tools/networking/zrok/default.nix
index a0d09cb488e1..96c4bd89f96d 100644
--- a/pkgs/tools/networking/zrok/default.nix
+++ b/pkgs/tools/networking/zrok/default.nix
@@ -1,15 +1,33 @@
 { stdenv, lib, fetchzip, patchelf }:
 
+let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "Unsupported system: ${system}";
+
+  plat = {
+    x86_64-linux = "linux_amd64";
+    aarch64-linux = "linux_arm64";
+    armv7l-linux = "linux_armv7";
+  }.${system} or throwSystem;
+
+  sha256 = {
+    x86_64-linux = "sha256-gcmgpvfk7bciTmotTHObvZvLPdLudAR2vQneLKN+uE4=";
+    aarch64-linux = "sha256-cZDekIW2Z7hfIY6Y4xhsmgvMLnKYo6H9BAMg9/I5a10=";
+    armv7l-linux = "sha256-Fn2e1ywuTUt58geT4hNb3YEZiJDE6TUKaKI/xpsG69c=";
+  }.${system} or throwSystem;
+in
 stdenv.mkDerivation rec {
   pname = "zrok";
   version = "0.3.6";
 
   src = fetchzip {
-    url = "https://github.com/openziti/zrok/releases/download/v${version}/zrok_${version}_linux_amd64.tar.gz";
+    url = "https://github.com/openziti/zrok/releases/download/v${version}/zrok_${version}_${plat}.tar.gz";
     stripRoot = false;
-    sha256 = "sha256-gcmgpvfk7bciTmotTHObvZvLPdLudAR2vQneLKN+uE4=";
+    inherit sha256;
   };
 
+  updateScript = ./update.sh;
+
   installPhase = let
     interpreter = "$(< \"$NIX_CC/nix-support/dynamic-linker\")";
   in ''
@@ -23,7 +41,7 @@ stdenv.mkDerivation rec {
     description = "Geo-scale, next-generation sharing platform built on top of OpenZiti";
     homepage = "https://zrok.io";
     maintainers = [ lib.maintainers.bandresen ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "armv7l-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.apsl20;
   };
diff --git a/pkgs/tools/networking/zrok/update.sh b/pkgs/tools/networking/zrok/update.sh
new file mode 100755
index 000000000000..71a09919a850
--- /dev/null
+++ b/pkgs/tools/networking/zrok/update.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused gawk nix-prefetch
+
+set -euo pipefail
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+NIX_DRV="$ROOT/default.nix"
+if [ ! -f "$NIX_DRV" ]; then
+  echo "ERROR: cannot find default.nix in $ROOT"
+  exit 1
+fi
+
+fetch_arch() {
+  VER="$1"; ARCH="$2"
+  URL="https://github.com/openziti/zrok/releases/download/v${VER}/zrok_${VER}_${ARCH}.tar.gz"
+  nix-prefetch "{ stdenv, fetchzip }:
+stdenv.mkDerivation rec {
+  pname = \"zrok\"; version = \"${VER}\";
+  src = fetchzip { url = \"$URL\"; stripRoot = false; };
+}
+"
+}
+
+replace_sha() {
+  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
+}
+
+ZROK_VER=$(curl -Ls -w "%{url_effective}" -o /dev/null https://github.com/openziti/zrok/releases/latest | awk -F'/' '{print $NF}' | sed 's/v//')
+
+ZROK_LINUX_X64_SHA256=$(fetch_arch "$ZROK_VER" "linux_amd64")
+ZROK_LINUX_AARCH64_SHA256=$(fetch_arch "$ZROK_VER" "linux_arm64")
+ZROK_LINUX_ARMV7L_SHA256=$(fetch_arch "$ZROK_VER" "linux_armv7")
+
+sed -i "s/version = \".*\"/version = \"$ZROK_VER\"/" "$NIX_DRV"
+
+replace_sha "x86_64-linux" "$ZROK_LINUX_X64_SHA256"
+replace_sha "aarch64-linux" "$ZROK_LINUX_AARCH64_SHA256"
+replace_sha "armv7l-linux" "$ZROK_LINUX_ARMV7L_SHA256"