{
  lib,
  fetchFromGitHub,
  stdenvNoCC,

  writers,
  nix-update,
}:
# Using `mkDerivation` so nix-update can pick up the version
stdenvNoCC.mkDerivation (drv: {
  pname = "crowdsec-hub";
  version = drv.src.rev;

  src = fetchFromGitHub {
    owner = "crowdsecurity";
    repo = "hub";
    rev = "b63d9e925cfdd70f818a6a136ea53d5c8ca96d9a";
    hash = "sha256-FMArGnR/pI/QlzsznStp8vzs/LbXooVgLdoTw+eSbec=";
  };

  installPhase = ''
    cp -r $src $out
  '';

  passthru.updateScript =
    writers.writeNuBin "update-crowdsec-hub"
      {
        makeWrapperArgs = [
          "--prefix"
          "PATH"
          ":"
          (lib.makeBinPath [ nix-update ])
        ];
      }
      ''
        nix-update --flake --format --version=branch crowdsec-hub
      '';
})