{
  lib,
  fetchFromGitHub,
  stdenvNoCC,

  writers,
  nix-update,
}:
# Using `mkDerivation` so nix-update can pick up the version
stdenvNoCC.mkDerivation (drv: {
  pname = "crowdsec-hub";
  version = drv.src.rev;

  src = fetchFromGitHub {
    owner = "crowdsecurity";
    repo = "hub";
    rev = "a0cac2433e16cb8de28667aca3b2719641849ab7";
    hash = "sha256-JlE8r1hiyWerWPpGIvQz/gNaGKyZ3VOZsMKp1MIrxRY=";
  };

  installPhase = ''
    cp -r $src $out
  '';

  passthru.updateScript =
    writers.writeNuBin "update-crowdsec-hub"
      {
        makeWrapperArgs = [
          "--prefix"
          "PATH"
          ":"
          (lib.makeBinPath [ nix-update ])
        ];
      }
      ''
        nix-update --flake --format --version=branch crowdsec-hub
      '';
})