diff --git a/pkgs/development/libraries/libcef/default.nix b/pkgs/development/libraries/libcef/default.nix
index d2ac5ef214ce..c6f2ba7f7228 100644
--- a/pkgs/development/libraries/libcef/default.nix
+++ b/pkgs/development/libraries/libcef/default.nix
@@ -102,6 +102,8 @@ stdenv.mkDerivation rec {
     cp -r ../include $out/
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     description = "Simple framework for embedding Chromium-based browsers in other applications";
     homepage = "https://cef-builds.spotifycdn.com/index.html";
diff --git a/pkgs/development/libraries/libcef/update.sh b/pkgs/development/libraries/libcef/update.sh
new file mode 100755
index 000000000000..545f7c702052
--- /dev/null
+++ b/pkgs/development/libraries/libcef/update.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused jq
+
+set -x -eu -o pipefail
+
+cd $(dirname "${BASH_SOURCE[0]}")
+
+VERSION_JSON=$(curl --silent https://cef-builds.spotifycdn.com/index.json | jq '[.linux64.versions[] | select (.channel == "stable")][0]')
+
+CEF_VERSION=$(echo ${VERSION_JSON} | jq -r '.cef_version' | cut -d'+' -f1)
+GIT_REVISION=$(echo ${VERSION_JSON} | jq -r '.cef_version' | cut -d'+' -f2 | cut -c 2-)
+CHROMIUM_VERSION=$(echo ${VERSION_JSON} | jq -r '.chromium_version')
+
+SHA256_LINUX64=$(nix-prefetch-url --quiet https://cef-builds.spotifycdn.com/cef_binary_${CEF_VERSION}+g${GIT_REVISION}+chromium-${CHROMIUM_VERSION}_linux64_minimal.tar.bz2)
+SHA256_LINUX32=$(nix-prefetch-url --quiet https://cef-builds.spotifycdn.com/cef_binary_${CEF_VERSION}+g${GIT_REVISION}+chromium-${CHROMIUM_VERSION}_linux32_minimal.tar.bz2)
+SHA256_LINUXARM64=$(nix-prefetch-url --quiet https://cef-builds.spotifycdn.com/cef_binary_${CEF_VERSION}+g${GIT_REVISION}+chromium-${CHROMIUM_VERSION}_linuxarm64_minimal.tar.bz2)
+
+setKV () {
+    sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" ./default.nix
+}
+
+setKV version ${CEF_VERSION}
+setKV gitRevision ${GIT_REVISION}
+setKV chromiumVersion ${CHROMIUM_VERSION}
+setKV 'platforms."aarch64-linux".sha256' ${SHA256_LINUXARM64}
+setKV 'platforms."i686-linux".sha256' ${SHA256_LINUX32}
+setKV 'platforms."x86_64-linux".sha256' ${SHA256_LINUX64}