diff --git a/pkgs/servers/monitoring/mimir/default.nix b/pkgs/servers/monitoring/mimir/default.nix
index 0c2b44c63a90..e0be7b8ec68e 100644
--- a/pkgs/servers/monitoring/mimir/default.nix
+++ b/pkgs/servers/monitoring/mimir/default.nix
@@ -1,13 +1,16 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests }:
+let 
+  pinData = lib.importJSON ./pin.json;
+in
 buildGoModule rec {
   pname = "mimir";
-  version = "2.4.0";
+  version = pinData.version;
 
   src = fetchFromGitHub {
     rev = "${pname}-${version}";
     owner = "grafana";
     repo = pname;
-    sha256 = "sha256-OpQxVp4Q2+r3Tqrqw3SrBsJDU5KJqChxsuYneT0PvYQ=";
+    sha256 = pinData.sha256;
   };
 
   vendorSha256 = null;
@@ -17,8 +20,11 @@ buildGoModule rec {
     "cmd/mimirtool"
   ];
 
-  passthru.tests = {
-    inherit (nixosTests) mimir;
+  passthru = {
+    updateScript = ./update.sh;
+    tests = {
+      inherit (nixosTests) mimir;
+    };
   };
 
   ldflags = let t = "github.com/grafana/mimir/pkg/util/version";
diff --git a/pkgs/servers/monitoring/mimir/pin.json b/pkgs/servers/monitoring/mimir/pin.json
new file mode 100644
index 000000000000..52e041745783
--- /dev/null
+++ b/pkgs/servers/monitoring/mimir/pin.json
@@ -0,0 +1,4 @@
+{
+  "version": "mimir-2.5.0",
+  "sha256": "sha256-lyF7ugnNEJug1Vx24ISrtENk6RoIt7H1zaCPYUZbBmM="
+}
diff --git a/pkgs/servers/monitoring/mimir/update.sh b/pkgs/servers/monitoring/mimir/update.sh
new file mode 100755
index 000000000000..242767c2ecb2
--- /dev/null
+++ b/pkgs/servers/monitoring/mimir/update.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i oil -p jq sd nix-prefetch-github ripgrep
+
+# TODO set to `verbose` or `extdebug` once implemented in oil
+shopt --set xtrace
+# we need failures inside of command subs to get the correct vendorSha256
+shopt --unset inherit_errexit
+
+const directory = $(dirname $0 | xargs realpath)
+const owner = "grafana"
+const repo = "mimir"
+const latest_rev = $(curl -q https://api.github.com/repos/${owner}/${repo}/releases/latest | \
+  jq -r '.tag_name')
+const latest_version = $(echo $latest_rev | sd 'v' '')
+const current_version = $(jq -r '.version' $directory/pin.json)
+if ("$latest_version" === "$current_version") {
+  echo "$repo is already up-to-date"
+  return 0
+} else {
+  const tarball_meta = $(nix-prefetch-github $owner $repo --rev "$latest_rev")
+  const tarball_hash = "sha256-$(echo $tarball_meta | jq -r '.sha256')"
+
+  jq ".version = \"$latest_version\" | \
+      .\"sha256\" = \"$tarball_hash\"" $directory/pin.json | sponge $directory/pin.json
+}