diff --git a/pkgs/tools/networking/wireguard-go/default.nix b/pkgs/tools/networking/wireguard-go/default.nix
index 6f168908585..83eecdb580f 100644
--- a/pkgs/tools/networking/wireguard-go/default.nix
+++ b/pkgs/tools/networking/wireguard-go/default.nix
@@ -13,6 +13,8 @@ buildGoPackage rec {
 
   goDeps = ./deps.nix;
 
+  passthru.updateScript = ./update.sh;
+
   meta = with stdenv.lib; {
     description = "Userspace Go implementation of WireGuard";
     homepage = https://git.zx2c4.com/wireguard-go/about/;
diff --git a/pkgs/tools/networking/wireguard-go/update.sh b/pkgs/tools/networking/wireguard-go/update.sh
new file mode 100755
index 00000000000..2b6b8317a1e
--- /dev/null
+++ b/pkgs/tools/networking/wireguard-go/update.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused common-updater-scripts vgo2nix
+
+set -eu -o pipefail
+
+basedir="$(git rev-parse --show-toplevel)"
+version="$(curl -sL https://build.wireguard.com/distros.txt | sed -n 's/^upstream\tgo\t\([^\t]\+\)\t.*/\1/p')"
+update-source-version wireguard-go "$version"
+
+vgo2nix -dir $(nix-build -A wireguard-go.src) -outfile "$basedir/pkgs/tools/networking/wireguard-go/deps.nix"
+
+if [[ -f "$basedir/wireguard-go.log" ]];then
+    rm "$basedir/wireguard-go.log"
+fi