diff --git a/pkgs/by-name/op/opengist/package.nix b/pkgs/by-name/op/opengist/package.nix
index ef8c6f5b82325..9c5fc9bd96526 100644
--- a/pkgs/by-name/op/opengist/package.nix
+++ b/pkgs/by-name/op/opengist/package.nix
@@ -3,39 +3,36 @@
   buildGoModule,
   buildNpmPackage,
   fetchFromGitHub,
+  fetchpatch,
   moreutils,
-  npm-lockfile-fix,
   jq,
   git,
 }:
 let
   # finalAttrs when 🥺 (buildGoModule does not support them)
   # https://github.com/NixOS/nixpkgs/issues/273815
-  version = "1.7.5";
+  version = "1.8.3";
   src = fetchFromGitHub {
     owner = "thomiceli";
     repo = "opengist";
     rev = "v${version}";
-    hash = "sha256-mZ4j9UWdKa3nygcRO5ceyONetkks3ZGWxvzD34eOXew=";
-
-    # follow https://github.com/thomiceli/opengist/pull/350 and remove here
-    postFetch = ''
-      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
-    '';
+    hash = "sha256-Wpn9rqOUwbwi6pbPTnVzHb+ip3ay9WykEZDyHNdXYJU=";
   };
 
   frontend = buildNpmPackage {
     pname = "opengist-frontend";
     inherit version src;
-
-    nativeBuildInputs = [
-      moreutils
-      jq
+    patches = [
+      # fix lock file
+      # https://github.com/thomiceli/opengist/pull/395
+      (fetchpatch {
+        url = "https://github.com/thomiceli/opengist/pull/395/commits/f77c624f73f18010c7e4360287d0a3c013c21c9d.patch";
+        hash = "sha256-oCMt1HptH0jsi2cvv8wEP0+bpujx1jBxCjw0KMDGFfk=";
+      })
     ];
-
     # npm complains of "invalid package". shrug. we can give it a version.
-    preBuild = ''
-      jq '.version = "${version}"' package.json | sponge package.json
+    postPatch = ''
+      ${lib.getExe jq} '.version = "${version}"' package.json | ${lib.getExe' moreutils "sponge"} package.json
     '';
 
     # copy pasta from the Makefile upstream, seems to be a workaround of sass
@@ -50,13 +47,13 @@ let
       cp -R public $out
     '';
 
-    npmDepsHash = "sha256-cITkgRvWOml6uH77WkiNgFedEuPNze63Gntet09uS5w=";
+    npmDepsHash = "sha256-fj2U8oRNfdIEnRkAOQQGiPyQFuWltLGkMzT2IQO60v0=";
   };
 in
 buildGoModule {
   pname = "opengist";
   inherit version src;
-  vendorHash = "sha256-6PpS/dsonc/akBn8NwUIVFNe2FjynAhF1TYIYT9K/ws=";
+  vendorHash = "sha256-mLFjRL4spAWuPLVOtt88KH+p2g9lGCYzaHokVxdrLOw=";
   tags = [ "fs_embed" ];
   ldflags = [
     "-s"
@@ -73,11 +70,20 @@ buildGoModule {
     export OG_OPENGIST_HOME=$(mktemp -d)
   '';
 
+  checkPhase = ''
+    runHook preCheck
+    make test
+    runHook postCheck
+  '';
+
   postPatch = ''
     cp -R ${frontend}/public/{manifest.json,assets} public/
   '';
 
-  passthru.frontend = frontend;
+  passthru = {
+    inherit frontend;
+    updateScript = ./update.sh;
+  };
 
   meta = {
     description = "Self-hosted pastebin powered by Git";
diff --git a/pkgs/by-name/op/opengist/update.sh b/pkgs/by-name/op/opengist/update.sh
new file mode 100755
index 0000000000000..ad3ac9ca639ae
--- /dev/null
+++ b/pkgs/by-name/op/opengist/update.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash curl coreutils jq git prefetch-npm-deps moreutils common-updater-scripts common-updater-scripts
+
+# shellcheck shell=bash
+
+set -eou pipefail
+
+NIXPKGS_DIR="$PWD"
+SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
+
+# Get latest release
+OPENGIST_RELEASE=$(
+    curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
+        https://api.github.com/repos/thomiceli/opengist/releases/latest
+)
+
+# Get release information
+latestVersion=$(echo "$OPENGIST_RELEASE" | jq -r ".tag_name")
+latestVersion="${latestVersion:1}" # remove first char 'v'
+
+oldVersion=$(nix eval --raw -f "$NIXPKGS_DIR" opengist.version)
+
+if [[ "$oldVersion" == "$latestVersion" ]]; then
+    echo "opengist is up-to-date: ${oldVersion}"
+    exit 0
+fi
+
+echo "Updating opengist $oldVersion -> $latestVersion"
+
+update-source-version opengist "${latestVersion}"
+
+pushd "$SCRIPT_DIR" >/dev/null || exit 1
+
+## npm hash
+rm -f package{,-lock}.json
+curl -sLO "https://raw.githubusercontent.com/thomiceli/opengist/refs/tags/v$latestVersion/package-lock.json"
+
+npmDepsHash="$(prefetch-npm-deps package-lock.json)"
+sed -E 's#\bnpmDepsHash = ".*?"#npmDepsHash = "'"$npmDepsHash"'"#' --in-place package.nix
+
+popd >/dev/null
+
+# nix-prefetch broken due to ninja finalAttrs.src.rev
+# nix-update with goModules broken for this package
+
+setKV () {
+    sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" "${SCRIPT_DIR}/package.nix"
+}
+
+setKV vendorHash "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" # The same as lib.fakeHash
+
+set +e
+VENDOR_HASH=$(nix-build --no-out-link -A opengist "$NIXPKGS_DIR" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
+set -e
+
+if [ -n "${VENDOR_HASH:-}" ]; then
+    setKV vendorHash "${VENDOR_HASH}"
+else
+    echo "Update failed. VENDOR_HASH is empty."
+    exit 1
+fi