diff --git a/pkgs/applications/editors/texmacs/darwin.nix b/pkgs/applications/editors/texmacs/darwin.nix
index 5d5843890e1..a5117f3a678 100644
--- a/pkgs/applications/editors/texmacs/darwin.nix
+++ b/pkgs/applications/editors/texmacs/darwin.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation {
     "${ghostscript}/bin:" +
     (if aspell == null then "" else "${aspell}/bin:") +
     (if tex == null then "" else "${tex}/bin:") +
-    (if netpbm == null then "" else "${netpbm}/bin:") +
+    (if netpbm == null then "" else "${stdenv.lib.getBin netpbm}/bin:") +
     (if imagemagick == null then "" else "${imagemagick}/bin:");
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/electronics/fped/default.nix b/pkgs/applications/science/electronics/fped/default.nix
index 4eb666ada7c..f93fddba8cb 100644
--- a/pkgs/applications/science/electronics/fped/default.nix
+++ b/pkgs/applications/science/electronics/fped/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   makeFlags = [
     "PREFIX=${placeholder "out"}"
     "LEX=flex"
-    "RGBDEF=${netpbm}/share/netpbm/misc/rgb.txt"
+    "RGBDEF=${netpbm.out}/share/netpbm/misc/rgb.txt"
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/graphics/netpbm/default.nix b/pkgs/tools/graphics/netpbm/default.nix
index b67e71c0fdf..8f3a5ea274e 100644
--- a/pkgs/tools/graphics/netpbm/default.nix
+++ b/pkgs/tools/graphics/netpbm/default.nix
@@ -1,56 +1,85 @@
-{ lib, stdenv, fetchsvn, pkgconfig, libjpeg, libpng, flex, zlib, perl, libxml2
-, makeWrapper, libtiff
-, enableX11 ? false, libX11 }:
+{ lib
+, stdenv
+, fetchsvn
+, pkgconfig
+, libjpeg
+, libpng
+, flex
+, zlib
+, perl
+, libxml2
+, makeWrapper
+, libtiff
+, enableX11 ? false
+, libX11
+}:
 
 stdenv.mkDerivation {
   # Determine version and revision from:
   # https://sourceforge.net/p/netpbm/code/HEAD/log/?path=/advanced
-  name = "netpbm-10.82.01";
+  name = "netpbm-10.89.1";
+
+  outputs = [ "bin" "out" "dev" ];
 
   src = fetchsvn {
     url = "https://svn.code.sf.net/p/netpbm/code/advanced";
-    rev = "3264";
-    sha256 = "17fmyjbxp1l18rma7gb0m8wd9kx2iwhqs8dd6fpalsn2cr8mf8hf";
+    rev = "3735";
+    sha256 = "hRepEUBlf83p77Amjze+Qz7XTHhCuPdV01K/UabR89Q=";
   };
 
-  postPatch = /* CVE-2005-2471, from Arch */ ''
-    substituteInPlace converter/other/pstopnm.c \
-      --replace '"-dSAFER"' '"-dPARANOIDSAFER"'
+  postPatch = ''
+    # Install libnetpbm.so symlink to correct destination
+    substituteInPlace lib/Makefile \
+      --replace '/sharedlink' '/lib'
   '';
 
-  buildInputs =
-    [ pkgconfig flex zlib perl libpng libjpeg libxml2 makeWrapper libtiff ]
-    ++ lib.optional enableX11 libX11;
+  nativeBuildInputs = [
+    pkgconfig
+    flex
+    makeWrapper
+  ];
+
+  buildInputs = [
+    zlib
+    perl
+    libpng
+    libjpeg
+    libxml2
+    libtiff
+  ] ++ lib.optional enableX11 libX11;
 
   configurePhase = ''
+    runHook preConfigure
+
     cp config.mk.in config.mk
-    echo "STATICLIB_TOO = n" >> config.mk
-    substituteInPlace "config.mk" \
-        --replace "TIFFLIB = NONE" "TIFFLIB = ${libtiff.out}/lib/libtiff.so" \
-        --replace "TIFFHDR_DIR =" "TIFFHDR_DIR = ${libtiff.dev}/include" \
-        --replace "JPEGLIB = NONE" "JPEGLIB = ${libjpeg.out}/lib/libjpeg.so" \
-        --replace "JPEGHDR_DIR =" "JPEGHDR_DIR = ${libjpeg.dev}/include"
-   '' + stdenv.lib.optionalString stdenv.isDarwin ''
+
+    # Disable building static library
+    echo "STATICLIB_TOO = N" >> config.mk
+
+    # Use libraries from Nixpkgs
+    echo "TIFFLIB = libtiff.so" >> config.mk
+    echo "TIFFLIB_NEEDS_JPEG = N" >> config.mk
+    echo "TIFFLIB_NEEDS_Z = N" >> config.mk
+    echo "JPEGLIB = libjpeg.so" >> config.mk
+
+    # Fix path to rgb.txt
+    echo "RGB_DB_PATH = $out/share/netpbm/misc/rgb.txt" >> config.mk
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
     echo "LDSHLIB=-dynamiclib -install_name $out/lib/libnetpbm.\$(MAJ).dylib" >> config.mk
     echo "NETPBMLIBTYPE = dylib" >> config.mk
     echo "NETPBMLIBSUFFIX = dylib" >> config.mk
+
+    runHook postConfigure
   '';
 
-  preBuild = ''
-    export LDFLAGS="-lz"
-    substituteInPlace "pm_config.in.h" \
-        --subst-var-by "rgbPath1" "$out/lib/rgb.txt" \
-        --subst-var-by "rgbPath2" "/var/empty/rgb.txt" \
-        --subst-var-by "rgbPath3" "/var/empty/rgb.txt"
-    touch lib/standardppmdfont.c
-  '';
-
-  enableParallelBuilding = false;
+  enableParallelBuilding = true;
 
   installPhase = ''
+    runHook preInstall
+
     make package pkgdir=$out
 
-    rm -rf $out/link $out/*_template $out/{pkginfo,README,VERSION} $out/man/web
+    rm -rf $out/*_template $out/{pkginfo,README,VERSION} $out/man/web
 
     mkdir -p $out/share/netpbm
     mv $out/misc $out/share/netpbm/
@@ -59,12 +88,18 @@ stdenv.mkDerivation {
     for prog in ppmquant; do
         wrapProgram "$out/bin/$prog" --prefix PATH : "$out/bin"
     done
+
+    moveToOutput bin "''${!outputBin}"
+
+    runHook postInstall
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
-    homepage = http://netpbm.sourceforge.net/;
+    homepage = "http://netpbm.sourceforge.net/";
     description = "Toolkit for manipulation of graphic images";
-    license = "GPL,free";
+    license = lib.licenses.free; # http://netpbm.svn.code.sourceforge.net/p/netpbm/code/trunk/doc/copyright_summary
     platforms = with stdenv.lib.platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/tools/graphics/netpbm/update.sh b/pkgs/tools/graphics/netpbm/update.sh
new file mode 100755
index 00000000000..670e872e951
--- /dev/null
+++ b/pkgs/tools/graphics/netpbm/update.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p bash -p subversion -p common-updater-scripts -i bash
+
+die() {
+    echo "error: $1" >&2
+    exit 1
+}
+
+attr=netpbm
+svnRoot=https://svn.code.sf.net/p/netpbm/code/advanced
+
+oldRev=$(nix-instantiate --eval -E "with import ./. {}; $attr.src.rev" | tr -d '"')
+if [[ -z "$oldRev" ]]; then
+    die "Could not extract old revision."
+fi
+
+latestRev=$(svn info --show-item "last-changed-revision" "$svnRoot")
+if [[ -z "$latestRev" ]]; then
+    die "Could not find out last changed revision."
+fi
+
+versionInfo=$(svn cat -r "$latestRev" "$svnRoot/version.mk")
+if [[ -z "$versionInfo" ]]; then
+    die "Could not get version info."
+fi
+
+nixFile=$(nix-instantiate --eval --strict -A "$attr.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/')
+if [[ ! -f "$nixFile" ]]; then
+    die "Could not evaluate '$attr.meta.position' to locate the .nix file!"
+fi
+
+# h remembers if we found the pattern; on the last line, if a pattern was previously found, we exit with 1
+# https://stackoverflow.com/a/12145797/160386
+sed -i "$nixFile" -re '/(\brev\b\s*=\s*)"'"$oldRev"'"/{ s||\1"'"$latestRev"'"|; h }; ${x; /./{x; q1}; x}' && die "Unable to update revision."
+
+majorRelease=$(grep --perl-regex --only-matching 'NETPBM_MAJOR_RELEASE = \K.+' <<< "$versionInfo")
+minorRelease=$(grep --perl-regex --only-matching 'NETPBM_MINOR_RELEASE = \K.+' <<< "$versionInfo")
+pointRelease=$(grep --perl-regex --only-matching 'NETPBM_POINT_RELEASE = \K.+' <<< "$versionInfo")
+
+update-source-version "$attr" "$majorRelease.$minorRelease.$pointRelease"
diff --git a/pkgs/tools/graphics/pfstools/default.nix b/pkgs/tools/graphics/pfstools/default.nix
index 6a0385614e8..668f73c04f4 100644
--- a/pkgs/tools/graphics/pfstools/default.nix
+++ b/pkgs/tools/graphics/pfstools/default.nix
@@ -18,9 +18,9 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     rm cmake/FindNETPBM.cmake
-    echo "SET(NETPBM_LIBRARY `find ${netpbm} -name "*.${stdenv.hostPlatform.extensions.sharedLibrary}*" -type f`)" >> cmake/FindNETPBM.cmake
-    echo "SET(NETPBM_LIBRARIES `find ${netpbm} -name "*.${stdenv.hostPlatform.extensions.sharedLibrary}*" -type f`)" >> cmake/FindNETPBM.cmake
-    echo "SET(NETPBM_INCLUDE_DIR ${netpbm}/include/netpbm)" >> cmake/FindNETPBM.cmake
+    echo "SET(NETPBM_LIBRARY `find ${stdenv.lib.getLib netpbm} -name "*.${stdenv.hostPlatform.extensions.sharedLibrary}*" -type f`)" >> cmake/FindNETPBM.cmake
+    echo "SET(NETPBM_LIBRARIES `find ${stdenv.lib.getLib netpbm} -name "*.${stdenv.hostPlatform.extensions.sharedLibrary}*" -type f`)" >> cmake/FindNETPBM.cmake
+    echo "SET(NETPBM_INCLUDE_DIR ${stdenv.lib.getDev netpbm}/include/netpbm)" >> cmake/FindNETPBM.cmake
     echo "INCLUDE(FindPackageHandleStandardArgs)" >> cmake/FindNETPBM.cmake
     echo "FIND_PACKAGE_HANDLE_STANDARD_ARGS(NETPBM DEFAULT_MSG NETPBM_LIBRARY NETPBM_INCLUDE_DIR)" >> cmake/FindNETPBM.cmake
   '';
diff --git a/pkgs/tools/graphics/sng/default.nix b/pkgs/tools/graphics/sng/default.nix
index c7d2f49406b..71bf0160a1e 100644
--- a/pkgs/tools/graphics/sng/default.nix
+++ b/pkgs/tools/graphics/sng/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libpng ];
 
   configureFlags = [
-    "--with-rgbtxt=${netpbm}/share/netpbm/misc/rgb.txt"
+    "--with-rgbtxt=${netpbm.out}/share/netpbm/misc/rgb.txt"
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/misc/yad/default.nix b/pkgs/tools/misc/yad/default.nix
index 776b41ac1aa..d6b1b423ae2 100644
--- a/pkgs/tools/misc/yad/default.nix
+++ b/pkgs/tools/misc/yad/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     sed -i src/form.c -e '21i#include <stdlib.h>'
 
     # there is no point to bring in the whole netpbm package just for this file
-    install -Dm644 ${netpbm}/share/netpbm/misc/rgb.txt $out/share/yad/rgb.txt
+    install -Dm644 ${netpbm.out}/share/netpbm/misc/rgb.txt $out/share/yad/rgb.txt
   '';
 
   postAutoreconf = ''
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index ec7e724d1fc..391e7543eca 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -29,13 +29,13 @@ stdenv.mkDerivation rec {
       --replace "psselect" "${psutils}/bin/psselect"
   '' + stdenv.lib.optionalString (netpbm != null) ''
     substituteInPlace src/preproc/html/pre-html.cpp \
-      --replace "pnmcut" "${netpbm}/bin/pnmcut" \
-      --replace "pnmcrop" "${netpbm}/bin/pnmcrop" \
-      --replace "pnmtopng" "${netpbm}/bin/pnmtopng"
+      --replace "pnmcut" "${stdenv.lib.getBin netpbm}/bin/pnmcut" \
+      --replace "pnmcrop" "${stdenv.lib.getBin netpbm}/bin/pnmcrop" \
+      --replace "pnmtopng" "${stdenv.lib.getBin netpbm}/bin/pnmtopng"
     substituteInPlace tmac/www.tmac \
-      --replace "pnmcrop" "${netpbm}/bin/pnmcrop" \
-      --replace "pngtopnm" "${netpbm}/bin/pngtopnm" \
-      --replace "@PNMTOPS_NOSETPAGE@" "${netpbm}/bin/pnmtops -nosetpage"
+      --replace "pnmcrop" "${stdenv.lib.getBin netpbm}/bin/pnmcrop" \
+      --replace "pngtopnm" "${stdenv.lib.getBin netpbm}/bin/pngtopnm" \
+      --replace "@PNMTOPS_NOSETPAGE@" "${stdenv.lib.getBin netpbm}/bin/pnmtops -nosetpage"
   '';
 
   buildInputs = [ ghostscript psutils netpbm perl ];