diff --git a/pkgs/applications/networking/cluster/octant/default.nix b/pkgs/applications/networking/cluster/octant/default.nix
index ebf3cb417d69..453c1406fd20 100644
--- a/pkgs/applications/networking/cluster/octant/default.nix
+++ b/pkgs/applications/networking/cluster/octant/default.nix
@@ -1,38 +1,53 @@
-{ lib, stdenv, fetchurl }:
-let
-  version = "0.16.3";
+{ lib, stdenv, fetchzip }:
 
-  system = stdenv.hostPlatform.system;
+let
+  inherit (stdenv.hostPlatform) system;
   suffix = {
     x86_64-linux = "Linux-64bit";
     aarch64-linux = "Linux-arm64";
     x86_64-darwin = "macOS-64bit";
   }."${system}" or (throw "Unsupported system: ${system}");
-
   baseurl = "https://github.com/vmware-tanzu/octant/releases/download";
-  fetchsrc = sha256: fetchurl {
-    url = "${baseurl}/v${version}/octant_${version}_${suffix}.tar.gz";
-    sha256 = sha256."${system}";
-  };
+  fetchsrc = version: sha256: fetchzip {
+      url = "${baseurl}/v${version}/octant_${version}_${suffix}.tar.gz";
+      sha256 = sha256."${system}";
+    };
 in
 stdenv.mkDerivation rec {
   pname = "octant";
-  inherit version;
+  version = "0.17.0";
 
-  src = fetchsrc {
-    x86_64-linux = "1c6v7d8i494k32b0zrjn4fn1idza95r6h99c33c5za4hi7gqvy0x";
-    aarch64-linux = "153jd4wsq8qc598w7y4d30dy20ljyhrl68cc3pig1p712l5258zs";
-    x86_64-darwin = "0y2qjdlyvhrzwg0fmxsr3jl39kd13276a7wg0ndhdjfwxvdwpxkz";
+  src = fetchsrc version {
+    x86_64-linux = "sha256-kYS8o97HBjNgwmrG4fjsqFWxZy6ATFOhxt6j3KMZbEc=";
+    aarch64-linux = "sha256-/Tpna2Y8+PQt+SeOJ9NDweRWGiQXU/sN+Wh/vLYQPwM=";
+    x86_64-darwin = "sha256-aOUmnD+l/Cc5qTiHxFLBjCatszmPdUc4YYZ6Oy5DT3U=";
   };
 
-  doCheck = false;
+  dontConfigure = true;
+  dontBuild = true;
 
   installPhase = ''
-    mkdir -p "$out/bin"
-    mv octant $out/bin
+    runHook preInstall
+    install -D octant $out/bin/octant
+    runHook postInstall
   '';
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/octant --help
+    $out/bin/octant version | grep "${version}"
+    runHook postInstallCheck
+  '';
+
+  dontPatchELF = true;
+  dontPatchShebangs = true;
+
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
+    homepage = "https://octant.dev/";
+    changelog = "https://github.com/vmware-tanzu/octant/blob/v${version}/CHANGELOG.md";
     description = "Highly extensible platform for developers to better understand the complexity of Kubernetes clusters.";
     longDescription = ''
       Octant is a tool for developers to understand how applications run on a Kubernetes cluster.
@@ -40,9 +55,8 @@ stdenv.mkDerivation rec {
       Octant offers a combination of introspective tooling, cluster navigation, and object management along with a
       plugin system to further extend its capabilities.
     '';
-    homepage = "https://octant.dev/";
     license = licenses.asl20;
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
     maintainers = with maintainers; [ jk ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
   };
 }
diff --git a/pkgs/applications/networking/cluster/octant/update.sh b/pkgs/applications/networking/cluster/octant/update.sh
new file mode 100755
index 000000000000..4ffe4aefb30c
--- /dev/null
+++ b/pkgs/applications/networking/cluster/octant/update.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused gawk nix-prefetch
+
+set -euo pipefail
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+NIX_DRV="$ROOT/default.nix"
+if [ ! -f "$NIX_DRV" ]; then
+  echo "ERROR: cannot find default.nix in $ROOT"
+  exit 1
+fi
+
+fetch_arch() {
+  VER="$1"; ARCH="$2"
+  URL="https://github.com/vmware-tanzu/octant/releases/download/v${VER}/octant_${VER}_${ARCH}.tar.gz"
+  nix-prefetch "{ stdenv, fetchzip }:
+stdenv.mkDerivation rec {
+  pname = \"octant\"; version = \"${VER}\";
+  src = fetchzip { url = \"$URL\"; };
+}
+"
+}
+
+replace_sha() {
+  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
+}
+
+OCTANT_VER=$(curl -Ls -w "%{url_effective}" -o /dev/null https://github.com/vmware-tanzu/octant/releases/latest | awk -F'/' '{print $NF}' | sed 's/v//')
+
+OCTANT_LINUX_X64_SHA256=$(fetch_arch "$OCTANT_VER" "Linux-64bit")
+OCTANT_DARWIN_X64_SHA256=$(fetch_arch "$OCTANT_VER" "Linux-arm64")
+OCTANT_LINUX_AARCH64_SHA256=$(fetch_arch "$OCTANT_VER" "macOS-64bit")
+
+sed -i "s/version = \".*\"/version = \"$OCTANT_VER\"/" "$NIX_DRV"
+
+replace_sha "x86_64-linux" "$OCTANT_LINUX_X64_SHA256"
+replace_sha "x86_64-darwin" "$OCTANT_LINUX_AARCH64_SHA256"
+replace_sha "aarch64-linux" "$OCTANT_DARWIN_X64_SHA256"