diff --git a/pkgs/tools/security/b3sum/add-cargo-lock.patch b/pkgs/tools/security/b3sum/cargo-lock.patch
similarity index 77%
rename from pkgs/tools/security/b3sum/add-cargo-lock.patch
rename to pkgs/tools/security/b3sum/cargo-lock.patch
index ecbb2b0bab9c..1f8494089477 100644
--- a/pkgs/tools/security/b3sum/add-cargo-lock.patch
+++ b/pkgs/tools/security/b3sum/cargo-lock.patch
@@ -1,9 +1,9 @@
-diff --git a/b3sum/Cargo.lock b/b3sum/Cargo.lock
+diff --git a/Cargo.lock b/Cargo.lock
 new file mode 100644
-index 0000000..1ce7abc
+index 0000000..1dff162
 --- /dev/null
 +++ b/Cargo.lock
-@@ -0,0 +1,495 @@
+@@ -0,0 +1,507 @@
 +# This file is automatically @generated by Cargo.
 +# It is not intended for manual editing.
 +[[package]]
@@ -17,9 +17,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "anyhow"
-+version = "1.0.31"
++version = "1.0.34"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "85bb70cc08ec97ca5450e6eba421deeea5f172c0fc61f78b5357b2a8e8be195f"
++checksum = "bf8dcb5b4bbaa28653b647d8c77bd4ed40183b48882e130c1f1ffb73de069fd7"
 +
 +[[package]]
 +name = "arrayref"
@@ -29,9 +29,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "arrayvec"
-+version = "0.5.1"
++version = "0.5.2"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "cff77d8686867eceff3105329d4698d96c2391c176d5d03adc90c7389162b5b8"
++checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
 +
 +[[package]]
 +name = "atty"
@@ -46,13 +46,13 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "autocfg"
-+version = "1.0.0"
++version = "1.0.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f8aac770f1885fd7e387acedd76065302551364496e46b3dd00860b2f8359b9d"
++checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
 +
 +[[package]]
 +name = "b3sum"
-+version = "0.3.4"
++version = "0.3.7"
 +dependencies = [
 + "anyhow",
 + "blake3",
@@ -73,12 +73,12 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "blake3"
-+version = "0.3.4"
++version = "0.3.7"
 +dependencies = [
 + "arrayref",
 + "arrayvec",
 + "cc",
-+ "cfg-if",
++ "cfg-if 0.1.10",
 + "constant_time_eq",
 + "crypto-mac",
 + "digest",
@@ -87,9 +87,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "cc"
-+version = "1.0.57"
++version = "1.0.62"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "0fde55d2a2bfaa4c9668bbc63f531fbdeee3ffe188f4662511ce2c22b3eedebe"
++checksum = "f1770ced377336a88a67c473594ccc14eca6f4559217c34f64aac8f83d641b40"
 +
 +[[package]]
 +name = "cfg-if"
@@ -98,10 +98,16 @@ index 0000000..1ce7abc
 +checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
 +
 +[[package]]
-+name = "clap"
-+version = "2.33.1"
++name = "cfg-if"
++version = "1.0.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "bdfa80d47f954d53a35a64987ca1422f495b8d6483c0fe9f7117b36c2a792129"
++checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
++
++[[package]]
++name = "clap"
++version = "2.33.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002"
 +dependencies = [
 + "ansi_term",
 + "atty",
@@ -113,64 +119,69 @@ index 0000000..1ce7abc
 +]
 +
 +[[package]]
++name = "const_fn"
++version = "0.4.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c478836e029dcef17fb47c89023448c64f781a046e0300e257ad8225ae59afab"
++
++[[package]]
 +name = "constant_time_eq"
 +version = "0.1.5"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
 +
 +[[package]]
-+name = "crossbeam-deque"
-+version = "0.7.3"
++name = "crossbeam-channel"
++version = "0.5.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "9f02af974daeee82218205558e51ec8768b48cf524bd01d550abe5573a608285"
++checksum = "dca26ee1f8d361640700bde38b2c37d8c22b3ce2d360e1fc1c74ea4b0aa7d775"
 +dependencies = [
++ "cfg-if 1.0.0",
++ "crossbeam-utils",
++]
++
++[[package]]
++name = "crossbeam-deque"
++version = "0.8.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "94af6efb46fef72616855b036a624cf27ba656ffc9be1b9a3c931cfc7749a9a9"
++dependencies = [
++ "cfg-if 1.0.0",
 + "crossbeam-epoch",
 + "crossbeam-utils",
-+ "maybe-uninit",
 +]
 +
 +[[package]]
 +name = "crossbeam-epoch"
-+version = "0.8.2"
++version = "0.9.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "058ed274caafc1f60c4997b5fc07bf7dc7cca454af7c6e81edffe5f33f70dace"
++checksum = "ec0f606a85340376eef0d6d8fec399e6d4a544d648386c6645eb6d0653b27d9f"
 +dependencies = [
-+ "autocfg",
-+ "cfg-if",
++ "cfg-if 1.0.0",
++ "const_fn",
 + "crossbeam-utils",
 + "lazy_static",
-+ "maybe-uninit",
 + "memoffset",
 + "scopeguard",
 +]
 +
 +[[package]]
-+name = "crossbeam-queue"
-+version = "0.2.3"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "774ba60a54c213d409d5353bda12d49cd68d14e45036a285234c8d6f91f92570"
-+dependencies = [
-+ "cfg-if",
-+ "crossbeam-utils",
-+ "maybe-uninit",
-+]
-+
-+[[package]]
 +name = "crossbeam-utils"
-+version = "0.7.2"
++version = "0.8.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "c3c7c73a2d1e9fc0886a08b93e98eb643461230d5f1925e4036204d5f2e261a8"
++checksum = "ec91540d98355f690a86367e566ecad2e9e579f230230eb7c21398372be73ea5"
 +dependencies = [
 + "autocfg",
-+ "cfg-if",
++ "cfg-if 1.0.0",
++ "const_fn",
 + "lazy_static",
 +]
 +
 +[[package]]
 +name = "crypto-mac"
-+version = "0.7.0"
++version = "0.8.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "4434400df11d95d556bac068ddfedd482915eb18fe8bea89bc80b6e4b1c179e5"
++checksum = "b584a330336237c1eecd3e94266efb216c56ed91225d634cb2991c5f3fd1aeab"
 +dependencies = [
 + "generic-array",
 + "subtle",
@@ -178,9 +189,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "digest"
-+version = "0.8.1"
++version = "0.9.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "f3d0c8c8752312f9713efd397ff63acb9f85585afbf179282e720e7704954dd5"
++checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
 +dependencies = [
 + "generic-array",
 +]
@@ -199,26 +210,27 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "either"
-+version = "1.5.3"
++version = "1.6.1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "bb1f6b1ce1c140482ea30ddd3335fc0024ac7ee112895426e0a629a6c20adfe3"
++checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
 +
 +[[package]]
 +name = "generic-array"
-+version = "0.12.3"
++version = "0.14.4"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "c68f0274ae0e023facc3c97b2e00f076be70e254bc851d972503b328db79b2ec"
++checksum = "501466ecc8a30d1d3b7fc9229b122b2ce8ed6e9d9223f1138d4babb253e51817"
 +dependencies = [
 + "typenum",
++ "version_check",
 +]
 +
 +[[package]]
 +name = "getrandom"
-+version = "0.1.14"
++version = "0.1.15"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "7abc8dd8451921606d809ba32e95b6111925cd2906060d2dcc29c070220503eb"
++checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
 +dependencies = [
-+ "cfg-if",
++ "cfg-if 0.1.10",
 + "libc",
 + "wasi",
 +]
@@ -231,9 +243,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "hermit-abi"
-+version = "0.1.15"
++version = "0.1.17"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "3deed196b6e7f9e44a2ae8d94225d80302d81208b1bb673fd21fe634645c85a9"
++checksum = "5aca5565f760fb5b220e499d72710ed156fdb74e631659e99377d9ebfbd13ae8"
 +dependencies = [
 + "libc",
 +]
@@ -252,15 +264,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "libc"
-+version = "0.2.71"
++version = "0.2.80"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "9457b06509d27052635f90d6466700c65095fdf75409b3fbdd903e988b886f49"
-+
-+[[package]]
-+name = "maybe-uninit"
-+version = "2.0.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "60302e4db3a61da70c0cb7991976248362f30319e88850c487b9b95bbf059e00"
++checksum = "4d58d1b70b004888f764dfbf6a26a3b0342a1632d33968e4a179d8011c760614"
 +
 +[[package]]
 +name = "memmap"
@@ -274,9 +280,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "memoffset"
-+version = "0.5.5"
++version = "0.5.6"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "c198b026e1bbf08a937e94c6c60f9ec4a2267f5b0d2eec9c1b21b061ce2be55f"
++checksum = "043175f069eda7b85febe4a74abbaeff828d9f8b448515d3151a14a3542811aa"
 +dependencies = [
 + "autocfg",
 +]
@@ -293,9 +299,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "once_cell"
-+version = "1.4.0"
++version = "1.5.2"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "0b631f7e854af39a1739f401cf34a8a013dfe09eac4fa4dba91e9768bd28168d"
++checksum = "13bd41f508810a131401606d54ac32a467c97172d74ba7662562ebba5ad07fa0"
 +
 +[[package]]
 +name = "os_pipe"
@@ -309,9 +315,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "ppv-lite86"
-+version = "0.2.8"
++version = "0.2.10"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "237a5ed80e274dbc66f86bd59c1e25edc039660be53194b5fe0a482e0f2612ea"
++checksum = "ac74c624d6b2d21f425f752262f42188365d7b8ff1aff74c82e45136510a4857"
 +
 +[[package]]
 +name = "rand"
@@ -356,9 +362,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "rayon"
-+version = "1.3.1"
++version = "1.5.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "62f02856753d04e03e26929f820d0a0a337ebe71f849801eea335d464b349080"
++checksum = "8b0d8e0819fadc20c74ea8373106ead0600e3a67ef1fe8da56e39b9ae7275674"
 +dependencies = [
 + "autocfg",
 + "crossbeam-deque",
@@ -368,12 +374,12 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "rayon-core"
-+version = "1.7.1"
++version = "1.9.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "e92e15d89083484e11353891f1af602cc661426deb9564c298b270c726973280"
++checksum = "9ab346ac5921dc62ffa9f89b7a773907511cdfa5490c572ae9be1be33e8afa4a"
 +dependencies = [
++ "crossbeam-channel",
 + "crossbeam-deque",
-+ "crossbeam-queue",
 + "crossbeam-utils",
 + "lazy_static",
 + "num_cpus",
@@ -381,9 +387,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "redox_syscall"
-+version = "0.1.56"
++version = "0.1.57"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2439c63f3f6139d1b57529d16bc3b8bb855230c8efcc5d3a896c8bea7c3b1e84"
++checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
 +
 +[[package]]
 +name = "remove_dir_all"
@@ -418,9 +424,9 @@ index 0000000..1ce7abc
 +
 +[[package]]
 +name = "subtle"
-+version = "1.0.0"
++version = "2.3.0"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
-+checksum = "2d67a5a62ba6e01cb2192ff309324cb4875d0c451d55fe2319433abe7a05a8ee"
++checksum = "343f3f510c2915908f155e94f17220b19ccfacf2a64a2a5d8004f2c3e311e7fd"
 +
 +[[package]]
 +name = "tempfile"
@@ -428,7 +434,7 @@ index 0000000..1ce7abc
 +source = "registry+https://github.com/rust-lang/crates.io-index"
 +checksum = "7a6e24d9338a0a5be79593e2fa15a648add6138caa803e2d5bc782c371732ca9"
 +dependencies = [
-+ "cfg-if",
++ "cfg-if 0.1.10",
 + "libc",
 + "rand",
 + "redox_syscall",
@@ -464,6 +470,12 @@ index 0000000..1ce7abc
 +checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
 +
 +[[package]]
++name = "version_check"
++version = "0.9.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b5a972e5669d67ba988ce3dc826706fb0a8b01471c088cb0b6110b805cc36aed"
++
++[[package]]
 +name = "wasi"
 +version = "0.9.0+wasi-snapshot-preview1"
 +source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/pkgs/tools/security/b3sum/default.nix b/pkgs/tools/security/b3sum/default.nix
index dd6a538d11d0..d36dfc8e18cb 100644
--- a/pkgs/tools/security/b3sum/default.nix
+++ b/pkgs/tools/security/b3sum/default.nix
@@ -2,25 +2,25 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "b3sum";
-  version = "0.3.4";
+  version = "0.3.7";
 
   src = fetchFromGitHub {
     owner = "BLAKE3-team";
     repo = "BLAKE3";
     rev = version;
-    sha256 = "02yyv91wvy5w7i05z6f3kzxm5x34a4xgkgmcqxnb0ivsxnnld73h";
+    sha256 = "0r3nj7jbrpb2gkkfa9h6nv6blrbv6dlrhxg131qnh340q1ysh0x7";
   };
 
   sourceRoot = "source/b3sum";
 
-  cargoSha256 = "0ycn5788dc925wx28sgfs121w4x7yggm4mnmwij829ka8859bymk";
+  cargoSha256 = "0n8hp83hw7g260vmf4qcicpca75faam7k0zmb0k4cdzsar96gdrr";
 
-  cargoPatches = [ ./add-cargo-lock.patch ];
+  cargoPatches = [ ./cargo-lock.patch ];
 
   meta = {
     description = "BLAKE3 cryptographic hash function";
     homepage = "https://github.com/BLAKE3-team/BLAKE3/";
-    maintainers = with lib.maintainers; [ fpletz ];
+    maintainers = with lib.maintainers; [ fpletz ivan ];
     license = with lib.licenses; [ cc0 asl20 ];
   };
 }
diff --git a/pkgs/tools/security/b3sum/update-cargo-lock.sh b/pkgs/tools/security/b3sum/update-cargo-lock.sh
new file mode 100755
index 000000000000..8c52ad5cf6c0
--- /dev/null
+++ b/pkgs/tools/security/b3sum/update-cargo-lock.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# This updates cargo-lock.patch for the b3sum version listed in default.nix.
+
+set -eu -o verbose
+
+here=$PWD
+version=$(cat default.nix | grep '^  version = "' | cut -d '"' -f 2)
+checkout=$(mktemp -d)
+git clone -b "$version" --depth=1 https://github.com/BLAKE3-team/BLAKE3 "$checkout"
+cd "$checkout"
+
+(cd b3sum && cargo generate-lockfile)
+mv b3sum/Cargo.lock ./
+git add -f Cargo.lock
+git diff HEAD -- Cargo.lock > "$here"/cargo-lock.patch
+
+cd "$here"
+rm -rf "$checkout"