diff --git a/pkgs/tools/admin/pulumi/data.nix b/pkgs/tools/admin/pulumi/data.nix
new file mode 100644
index 000000000000..1edc80c24e2c
--- /dev/null
+++ b/pkgs/tools/admin/pulumi/data.nix
@@ -0,0 +1,51 @@
+# DO NOT EDIT! This file is generated automatically by update.sh
+{ }:
+{
+  version = "1.4.0";
+  pulumiPkgs = {
+    x86_64-linux = [
+      {
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v1.4.0-linux-x64.tar.gz";
+        sha256 = "00ywy2ba4xha6gwd42i3fdrk1myivkd1r6ijdr2vkianmg524k6f";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v0.2.0-linux-amd64.tar.gz";
+        sha256 = "1hj4gysjipd091f106a7xz02g9cail5d11rn6j08m0xphg9cf3fn";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v1.4.1-linux-amd64.tar.gz";
+        sha256 = "0r6xpsb2riqmxwxw28lbi3xd7w4ds510gw99j1rr57h5b9bq19jj";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v1.2.3-linux-amd64.tar.gz";
+        sha256 = "0m7fajy3cy1agsz787ak548khwj8rwahs1ibaswqfyyw092iyzb9";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v1.7.0-linux-amd64.tar.gz";
+        sha256 = "1qw90l7h8yn06bz2l2995nbrc3svs223dm3ys1807amj4n2jyfwb";
+      }
+    ];
+    x86_64-darwin = [
+      {
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v1.4.0-darwin-x64.tar.gz";
+        sha256 = "02vqw9gn17dy3rfh0j00k9f827l42g3nl3rhlcbc8jbgx3n9c9qy";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v0.2.0-darwin-amd64.tar.gz";
+        sha256 = "077j9fp8ix00rcqrq8qxk3kvz6gz6sknzb2iv3qjvkh6yh292mz3";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v1.4.1-darwin-amd64.tar.gz";
+        sha256 = "1i2vf3bxwf8awvw183hq9bbnmznda1jpv1zqghgz2ybx4s0915nx";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-kubernetes-v1.2.3-darwin-amd64.tar.gz";
+        sha256 = "123czx1c31r5r91k2jhdgmnffypnl8w1a6h9mr2rdhwgbx8hzq40";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v1.7.0-darwin-amd64.tar.gz";
+        sha256 = "0cl0vakppxi0v8ym8b4fzhzb10nl84wd0vfik8gpfwsg7zwdzhlp";
+      }
+    ];
+  };
+}
diff --git a/pkgs/tools/admin/pulumi/default.nix b/pkgs/tools/admin/pulumi/default.nix
index bba5c7e09cf4..977c1991faba 100644
--- a/pkgs/tools/admin/pulumi/default.nix
+++ b/pkgs/tools/admin/pulumi/default.nix
@@ -3,26 +3,16 @@
 with lib;
 
 let
-
-  version = "1.4.0";
-
-  # switch the dropdown to “manual” on https://pulumi.io/quickstart/install.html # TODO: update script
-  pulumiArchPackage = {
-    x86_64-linux = {
-      url = "https://get.pulumi.com/releases/sdk/pulumi-v${version}-linux-x64.tar.gz";
-      sha256 = "00ywy2ba4xha6gwd42i3fdrk1myivkd1r6ijdr2vkianmg524k6f";
-    };
-    x86_64-darwin = {
-      url = "https://get.pulumi.com/releases/sdk/pulumi-v${version}-darwin-x64.tar.gz";
-      sha256 = "02vqw9gn17dy3rfh0j00k9f827l42g3nl3rhlcbc8jbgx3n9c9qy";
-    };
-  };
-
+  data = import ./data.nix {};
 in stdenv.mkDerivation {
-  inherit version;
   pname = "pulumi";
+  version = data.version;
 
-  src = fetchurl pulumiArchPackage.${stdenv.hostPlatform.system};
+  postUnpack = ''
+    mv pulumi-* pulumi
+  '';
+
+  srcs = map (x: fetchurl x) data.pulumiPkgs.${stdenv.hostPlatform.system};
 
   installPhase = ''
     mkdir -p $out/bin
@@ -35,9 +25,10 @@ in stdenv.mkDerivation {
     homepage = https://pulumi.io/;
     description = "Pulumi is a cloud development platform that makes creating cloud programs easy and productive";
     license = with licenses; [ asl20 ];
-    platforms = builtins.attrNames pulumiArchPackage;
+    platforms = builtins.attrNames data.pulumiPkgs;
     maintainers = with maintainers; [
       peterromfeldhk
+      jlesquembre
     ];
   };
 }
diff --git a/pkgs/tools/admin/pulumi/update.sh b/pkgs/tools/admin/pulumi/update.sh
new file mode 100644
index 000000000000..7cb500ee9d32
--- /dev/null
+++ b/pkgs/tools/admin/pulumi/update.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+VERSION="1.4.0"
+
+declare -A plugins
+plugins=(
+    ["aws"]="1.7.0"
+    ["gcp"]="1.4.1"
+    ["kubernetes"]="1.2.3"
+    ["random"]="0.2.0"
+)
+
+function genMainSrc() {
+    local url="https://get.pulumi.com/releases/sdk/pulumi-v${VERSION}-$1-x64.tar.gz"
+    local sha256
+    sha256=$(nix-prefetch-url "$url")
+    echo "      {"
+    echo "        url = \"${url}\";"
+    echo "        sha256 = \"$sha256\";"
+    echo "      }"
+}
+
+function genSrcs() {
+    for plug in "${!plugins[@]}"; do
+        local version=${plugins[$plug]}
+        # url as defined here
+        # https://github.com/pulumi/pulumi/blob/06d4dde8898b2a0de2c3c7ff8e45f97495b89d82/pkg/workspace/plugins.go#L197
+        local url="https://api.pulumi.com/releases/plugins/pulumi-resource-${plug}-v${version}-$1-amd64.tar.gz"
+        local sha256
+        sha256=$(nix-prefetch-url "$url")
+        echo "      {"
+        echo "        url = \"${url}\";"
+        echo "        sha256 = \"$sha256\";"
+        echo "      }"
+    done
+}
+
+cat <<EOF
+# DO NOT EDIT! This file is generated automatically by update.sh
+{ }:
+{
+  version = "${VERSION}";
+  pulumiPkgs = {
+    x86_64-linux = [
+EOF
+genMainSrc "linux"
+genSrcs "linux"
+echo "    ];"
+
+echo "    x86_64-darwin = ["
+genMainSrc "darwin"
+genSrcs "darwin"
+echo "    ];"
+echo "  };"
+echo "}"