diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
index 20058e7bc821..e882ddd69b43 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@@ -1,12 +1,18 @@
-{ stdenvNoCC, fetchzip, lib }:
+let
+  source = import ./source.nix;
+in {
+  stdenvNoCC,
+  fetchzip,
+  lib,
+}:
 
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = "20220815";
+  version = source.version;
 
   src = fetchzip {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${version}.tar.gz";
-    sha256 = "sha256-StPlnwn4KOvOf4fRblDzJQqyI8iIz8e9fo/BsTyCKjI=";
+    hash = source.sourceHash;
   };
 
   installFlags = [ "DESTDIR=$(out)" ];
@@ -16,7 +22,7 @@ stdenvNoCC.mkDerivation rec {
 
   outputHashMode = "recursive";
   outputHashAlgo = "sha256";
-  outputHash = "sha256-VTRrOOkdWepUCKAkziO/0egb3oaQEOJCtsuDEgs/W78=";
+  outputHash = source.outputHash;
 
   meta = with lib; {
     description = "Binary firmware collection packaged by kernel.org";
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
new file mode 100644
index 000000000000..a0f049ce1347
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@@ -0,0 +1,6 @@
+# This file is autogenerated! Run ./update.sh to regenerate.
+{
+  version = "20220913";
+  sourceHash = "sha256-qxSgkytJBW9ux95tEOHfz/4pvOp5TII3ICAY7dg5UC8=";
+  outputHash = "sha256-eVDXNyx9gwa46pBmsoTU9bQ2XBzkjVocIHydieJ9ruU=";
+}
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/update.sh b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
new file mode 100755
index 000000000000..cd711db7de40
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$(readlink -f "$0")")" || exit
+
+# step 1: figure out the latest version from the tags
+repo="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git"
+latestTag="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
+
+# step 2: prefetch the source tarball
+snapshotUrl="$repo/snapshot/linux-firmware-$latestTag.tar.gz"
+hash="$(nix-prefetch-url --unpack "$snapshotUrl")"
+sriHash="$(nix --experimental-features nix-command hash to-sri "sha256:$hash")"
+
+# step 3: rebuild as a non-FO derivation to get the right hash
+cat > source.nix << EOF
+{
+  version = "$latestTag";
+  sourceHash = "$sriHash";
+  outputHash = null;
+}
+EOF
+
+outPath="$(nix --experimental-features "nix-command flakes" build ".#linux-firmware" --no-link --print-out-paths)"
+outHash="$(nix --experimental-features nix-command hash path "$outPath")"
+
+# step 4: generate the final file
+cat > source.nix << EOF
+# This file is autogenerated! Run ./update.sh to regenerate.
+{
+  version = "$latestTag";
+  sourceHash = "$sriHash";
+  outputHash = "$outHash";
+}
+EOF