{
  lib,
  fetchFromGitHub,
  stdenvNoCC,

  writers,
  nix-update,
}:
# Using `mkDerivation` so nix-update can pick up the version
stdenvNoCC.mkDerivation (drv: {
  pname = "crowdsec-hub";
  version = drv.src.rev;

  src = fetchFromGitHub {
    owner = "crowdsecurity";
    repo = "hub";
    rev = "2c5a8cb7b61ad56d7107a1ce5b2a0503fd647eda";
    hash = "sha256-3R7aHzChKaOvghkCb/YyQ6H/WR4U18YobiUCQUrwYQ4=";
  };

  installPhase = ''
    cp -r $src $out
  '';

  passthru.updateScript =
    writers.writeNuBin "update-crowdsec-hub"
      {
        makeWrapperArgs = [
          "--prefix"
          "PATH"
          ":"
          (lib.makeBinPath [ nix-update ])
        ];
      }
      ''
        nix-update --flake --format --version=branch crowdsec-hub
      '';
})