diff --git a/pkgs/development/compilers/graalvm/community-edition/default.nix b/pkgs/development/compilers/graalvm/community-edition/default.nix
index 1921b1c4f58d..9ce6a98e1cd9 100644
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@@ -9,10 +9,19 @@ in
   inherit mkGraal;
 
   graalvm11-ce = mkGraal rec {
-    version = lib.fileContents ./version;
+    version = "21.3.0";
     javaVersion = "11";
     platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
   };
 
-  # TODO: added graalvm17-ce
+  # TODO: fix aarch64-linux, failing during Native Image compilation
+  # "Caused by: java.io.IOException: Cannot run program
+  # "/nix/store/1q1mif7h3lgxdaxg6j39hli5azikrfla-gcc-wrapper-9.3.0/bin/gcc" (in
+  # directory"/tmp/SVM-4194439592488143713"): error=0, Failed to exec spawn
+  # helper: pid: 19865, exit value: 1"
+  graalvm17-ce = mkGraal rec {
+    version = "21.3.0";
+    javaVersion = "17";
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
index 2f59a40f9c9a..98f3b2703c4f 100644
--- a/pkgs/development/compilers/graalvm/community-edition/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
@@ -4,39 +4,53 @@
   {
     sha256 = {
       "11-linux-aarch64" = "0hsjxp6ly7jsn9k94fddcl7afc5gda66jyppcnfvslishbizqd0i";
+      "17-linux-aarch64" = "09hzl80m7f5ppmcvryz9aq0yw9scdkp5dqhblrqnkzyhvdjl5ycn";
       "11-linux-amd64" = "1ylk5l933z813k0k1xlayiv8fa0f1gmpr66bma51532iy3mch6rs";
+      "17-linux-amd64" = "1xn3shwkai61vvzsg595k8776a21ds00w2pjlscvfcbs1ag07n0i";
       "11-darwin-amd64" = "0qpqnnmqxvxzj3mwz05acpg4n8ffqsz0sji8lbl03fgswpvgfavc";
+      "17-darwin-amd64" = "1akpsrd9r2igcls0cvhpqw3jrnh59m8z80knx83lmj0cj836a8v0";
     }.${javaVersionPlatform} or null;
     url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/graalvm-ce-java${javaVersionPlatform}-21.3.0.tar.gz";
   }
   {
     sha256 = {
       "11-linux-aarch64" = "0qlmg5fwvqsb5ab3irj2hrcd5jc94mibnlz1gvzpnq85rw1zcb6h";
+      "17-linux-aarch64" = "0jmarhwngs6vpbcgsix0dxhj42qj9vnk3vln8fhdxmydwnns8r1m";
       "11-linux-amd64" = "0kvnjr55rizy53vn0ff9w27z1qh9d1vp3s7r1kdl0wyhrbhd8n49";
+      "17-linux-amd64" = "0h14sml42jda54agjs1prfnyjaxxsc67350fr51n8p20nl28lj6z";
       "11-darwin-amd64" = "1mg8c8hh8wmbwsisgarmp35jd0dall1fwdv49mggp74hicbc32h3";
+      "17-darwin-amd64" = "0qz0xf2ph9gi45vvri7vphxh35m11nk7sa8nkwxl28l8bza0kb40";
     }.${javaVersionPlatform} or null;
     url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/native-image-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
   }
   {
     sha256 = {
       "11-linux-aarch64" = "02rvwl1nng8d3qn226rjx5yq2blxs4yz009ab928qanhmb4vhv8b";
+      "17-linux-aarch64" = "13kaxbgfp9pm6s28i5hfyg957iiwzrxf0ibibkv2yndgj64vj8xg";
       "11-linux-amd64" = "0zz62zr7imjaw9a3j5m66xs7c72cqb1i74ab3rnlh0dgs1mdpljg";
+      "17-linux-amd64" = "1v2iwznlav8dsjj30nlhvsvv7pxmyzkhkp1p7spjjma09d34q4iv";
       "11-darwin-amd64" = "1wiv0299b2xrc229alczmjfj1bsn90p0wdm64rr39xnyyhbqrr80";
+      "17-darwin-amd64" = "095sii8ibjcvvc6wnxk77ax151c4zgj8bpp81q3kyaazgpzvrk5s";
     }.${javaVersionPlatform} or null;
     url = "https://github.com/oracle/truffleruby/releases/download/vm-21.3.0/ruby-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
   }
   {
     sha256 = {
       "11-linux-aarch64" = "1ck4c1z98h1zn4i6xhh1hb6w2jab6n17ddykb72xxw4vig9nhlc7";
+      "17-linux-aarch64" = "0p9gx5iq730br9wvacxs4403anxnjln6mx8v0dl4w4lhikjxsy8x";
       "11-linux-amd64" = "0gy8jj9d9msmj0i44sysiwq3j2k2w2g47fhq6y1aq47n3kmwj9kv";
+      "17-linux-amd64" = "0qk8rgbmnk84isnb33x5bbh17bnnmq9yqasfgy5p953min6pbxj7";
       "11-darwin-amd64" = "0agw6k3jn2jh8wyc9h8rvzlgs96qh4nlj0y8nyzsmidvwq2ahl00";
+      "17-darwin-amd64" = "0l1il0rq48sw6sha9jr0xphjgrm7q0kywy8z94mabm9maqh7l3rn";
     }.${javaVersionPlatform} or null;
     url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-21.3.0/wasm-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
   }
   {
     sha256 = {
       "11-linux-amd64" = "1l5av2v459q88zfl83877h7b3426z3d86kp6wqjvz2441brvidi0";
+      "17-linux-amd64" = "100p1cgw0z4yfy4axb3gr32m8jnyx1f8bj6f6kk0mf3l8fv2kb7p";
       "11-darwin-amd64" = "06694n74dzsfwlli1sjdsrfbj9ngw7bhrcayvy4sgy2va5qpdjs0";
+      "17-darwin-amd64" = "1qwg45q0760lsa62h0nk2zdv0r1npr82bh6p1z3md6pjppm7i025";
     }.${javaVersionPlatform} or null;
     url = "https://github.com/graalvm/graalpython/releases/download/vm-21.3.0/python-installable-svm-java${javaVersionPlatform}-21.3.0.jar";
   }
diff --git a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
index 8b0ff22af0a1..2b1aa6b64694 100644
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@@ -1,4 +1,4 @@
-{ version, javaVersion, platforms }:
+{ version, javaVersion, platforms, hashes ? import ./hashes.nix }:
 
 { stdenv, lib, fetchurl, autoPatchelfHook, setJavaClassPath, makeWrapper
 # minimum dependencies
@@ -35,9 +35,7 @@ let
         maybeFetchUrl = url: if url.sha256 != null then (fetchurl url) else null;
       in
       (lib.remove null
-        (map
-          maybeFetchUrl
-          (import ./hashes.nix { inherit javaVersionPlatform; })));
+        (map maybeFetchUrl (hashes { inherit javaVersionPlatform; })));
 
     buildInputs = lib.optionals stdenv.isLinux [
       alsa-lib # libasound.so wanted by lib/libjsound.so
@@ -111,12 +109,6 @@ let
     outputs = [ "out" "lib" ];
 
     installPhase = let
-      nativePRNGWorkaround = path: ''
-        # BUG workaround http://mail.openjdk.java.net/pipermail/graal-dev/2017-December/005141.html
-        substituteInPlace ${path} \
-          --replace file:/dev/random    file:/dev/./urandom \
-          --replace NativePRNGBlocking  SHA1PRNG
-      '';
       copyClibrariesToOut = basepath: ''
         # provide libraries needed for static compilation
         for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do
@@ -134,25 +126,30 @@ let
       '';
     in {
       "11-linux-amd64" = ''
-        ${nativePRNGWorkaround "$out/conf/security/java.security"}
+        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
 
+        ${copyClibrariesToLib}
+      '';
+      "17-linux-amd64" = ''
         ${copyClibrariesToOut "$out/lib/svm/clibraries"}
 
         ${copyClibrariesToLib}
       '';
       "11-linux-aarch64" = ''
-        ${nativePRNGWorkaround "$out/conf/security/java.security"}
-
         ${copyClibrariesToOut "$out/lib/svm/clibraries"}
 
         ${copyClibrariesToLib}
       '';
-      "11-darwin-amd64" = ''
-        # create empty $lib/lib to avoid breaking builds
-        mkdir -p $lib/lib
-        ${nativePRNGWorkaround "$out/conf/security/java.security"}
+      "17-linux-aarch64" = ''
+        ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+
+        ${copyClibrariesToLib}
       '';
+      "11-darwin-amd64" = "";
+      "17-darwin-amd64" = "";
     }.${javaVersionPlatform} + ''
+      # ensure that $lib/lib exists to avoid breaking builds
+      mkdir -p $lib/lib
       # jni.h expects jni_md.h to be in the header search path.
       ln -s $out/include/linux/*_md.h $out/include/
     '';
@@ -237,9 +234,12 @@ let
       }
 
       echo "Testing TruffleRuby"
+      # Hide warnings about wrong locale
+      export LANG=C
+      export LC_ALL=C
       $out/bin/ruby -e 'puts(1 + 1)'
-
-      ${# TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
+      ${# FIXME: irb is broken in all platforms
+        # TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
         # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
         # though `openssl` is in `propagatedBuildInputs`. For more details see:
         # https://github.com/NixOS/nixpkgs/pull/105815
@@ -252,7 +252,7 @@ let
           echo '1 + 1' | $out/bin/irb
         ''
       }
-      '';
+    '';
 
     passthru = {
       home = graalvmXXX-ce;
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.sh b/pkgs/development/compilers/graalvm/community-edition/update.sh
index ba063b2a96aa..c821c83a59c8 100755
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -p curl -i bash coreutils nix common-updater-scripts curl jq
+#!nix-shell -p coreutils curl nix jq gnused -i bash
 
 set -eou pipefail
 
@@ -13,18 +13,23 @@ verlte() {
     [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
 }
 
-readonly old_version="$(cat version)"
+readonly nixpkgs=../../../../..
+
+readonly old_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm11-ce.version)"
 
 if [[ -z "${1:-}" ]]; then
-  readonly gh_version="$(curl -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | jq --raw-output .tag_name)"
+  readonly gh_version="$(curl \
+      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
+      -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | \
+      jq --raw-output .tag_name)"
   readonly new_version="${gh_version//vm-/}"
 else
   readonly new_version="$1"
 fi
 
-if verlte "$new_version" "$old_version"; then
-  info "graalvm-ce $old_version is up-to-date. Exiting..."
-  exit 0
+if verlte "$old_version" "$new_version"; then
+  info "graalvm-ce $old_version is up-to-date."
+  [[ -z "${FORCE:-}" ]]  && exit 0
 else
   info "graalvm-ce $old_version is out-of-date. Updating..."
 fi
@@ -39,8 +44,11 @@ readonly urls=(
 
 readonly platforms=(
   "11-linux-aarch64"
+  "17-linux-aarch64"
   "11-linux-amd64"
+  "17-linux-amd64"
   "11-darwin-amd64"
+  "17-darwin-amd64"
 )
 
 info "Deleting old hashes.nix file..."
@@ -66,7 +74,8 @@ done
 
 echo_file "]"
 
-info "Updating 'version' file..."
-echo "$new_version" > version
+info "Updating graalvm-ce version..."
+# update-source-version does not work here since it expects src attribute
+sed "s|$old_version|\"$new_version\"|" -i default.nix
 
 info "Done!"
diff --git a/pkgs/development/compilers/graalvm/community-edition/version b/pkgs/development/compilers/graalvm/community-edition/version
deleted file mode 100644
index 54d3ad73646d..000000000000
--- a/pkgs/development/compilers/graalvm/community-edition/version
+++ /dev/null
@@ -1 +0,0 @@
-21.3.0
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index fb6c832884c1..b6ef8590684f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12218,6 +12218,7 @@ with pkgs;
       inherit (darwin.apple_sdk.frameworks) Foundation;
     });
   graalvm11-ce = graalvmCEPackages.graalvm11-ce;
+  graalvm17-ce = graalvmCEPackages.graalvm17-ce;
 
   inherit (callPackages ../development/compilers/graalvm/enterprise-edition.nix { })
     graalvm8-ee