diff --git a/pkgs/servers/http/nginx/generic.nix b/pkgs/servers/http/nginx/generic.nix
index 983b003d2748..e18c7d1ac2ef 100644
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -46,9 +46,7 @@ outer@{
   postInstall ? "",
   meta ? null,
   nginx-doc ? outer.nginx-doc,
-  passthru ? {
-    tests = { };
-  },
+  passthru ? { },
 }:
 
 let
@@ -281,25 +279,28 @@ stdenv.mkDerivation {
 
   passthru = {
     inherit modules;
-    tests = {
-      inherit (nixosTests)
-        nginx
-        nginx-auth
-        nginx-etag
-        nginx-etag-compression
-        nginx-globalredirect
-        nginx-http3
-        nginx-proxyprotocol
-        nginx-pubhtml
-        nginx-sso
-        nginx-status-page
-        nginx-unix-socket
-        ;
-      variants = lib.recurseIntoAttrs nixosTests.nginx-variants;
-      acme-integration = nixosTests.acme.nginx;
-      acme-integration-without-reload = nixosTests.acme.nginx-without-reload;
-    }
-    // passthru.tests;
+    tests =
+      passthru.tests or {
+        inherit (nixosTests)
+          nginx
+          nginx-auth
+          nginx-etag
+          nginx-etag-compression
+          nginx-globalredirect
+          nginx-http3
+          nginx-proxyprotocol
+          nginx-pubhtml
+          nginx-sso
+          nginx-status-page
+          nginx-unix-socket
+          ;
+        variants = lib.recurseIntoAttrs nixosTests.nginx-variants;
+        acme-integration = nixosTests.acme.nginx;
+        acme-integration-without-reload = nixosTests.acme.nginx-without-reload;
+      };
+  }
+  // lib.optionalAttrs (passthru ? updateScript) {
+    inherit (passthru) updateScript;
   };
 
   meta =
diff --git a/pkgs/servers/http/openresty/default.nix b/pkgs/servers/http/openresty/default.nix
index 8e60573f4a51..4910c45a196a 100644
--- a/pkgs/servers/http/openresty/default.nix
+++ b/pkgs/servers/http/openresty/default.nix
@@ -3,21 +3,27 @@
   runCommand,
   lib,
   fetchurl,
+  groff,
   perl,
   libpq,
+  makeWrapper,
   nixosTests,
   withPostgres ? true,
+  curl,
+  jq,
+  nix-update,
+  writeShellApplication,
   ...
 }@args:
 
 callPackage ../nginx/generic.nix args rec {
   pname = "openresty";
-  nginxVersion = "1.27.1";
-  version = "${nginxVersion}.2";
+  version = "1.31.1.1";
+  nginxVersion = lib.concatStringsSep "." (lib.init (lib.splitString "." version));
 
   src = fetchurl {
     url = "https://openresty.org/download/openresty-${version}.tar.gz";
-    sha256 = "sha256-dPB29+NksqmabF+btTHCdhDHiYWr6Va0QrGSoilfdUg=";
+    hash = "sha256-ZbeLqt0/CYQFXeib8T9KGTLlv+nDGTIDehNOorGgzkI=";
   };
 
   # generic.nix applies fixPatch on top of every patch defined there.
@@ -36,6 +42,7 @@ callPackage ../nginx/generic.nix args rec {
 
   nativeBuildInputs = [
     libpq.pg_config
+    makeWrapper
     perl
   ];
 
@@ -57,10 +64,41 @@ callPackage ../nginx/generic.nix args rec {
     ln -s $out/nginx/bin/nginx $out/bin/nginx
     ln -s $out/nginx/conf $out/conf
     ln -s $out/nginx/html $out/html
+
+    wrapProgram $out/bin/restydoc \
+      --prefix PATH : ${groff}/bin
+
+    substituteInPlace $out/bin/resty \
+      --replace-fail "'bin/nginx'" "'$out/bin/nginx'"
   '';
 
-  passthru.tests = {
-    inherit (nixosTests) openresty-lua;
+  passthru = {
+    tests = {
+      inherit (nixosTests) openresty-lua;
+      inherit (nixosTests.nginx-variants) openresty;
+    };
+    updateScript = lib.getExe (writeShellApplication {
+      name = "openresty-update";
+      runtimeInputs = [
+        curl
+        jq
+        nix-update
+      ];
+      text = ''
+        version="$(
+          curl -fsSL https://api.github.com/repos/openresty/openresty/tags?per_page=1 |
+            jq -r '.[0].name' |
+            sed 's/^v//'
+        )"
+        echo "Local: ${version}"
+        echo "Latest: $version"
+
+        nix-update \
+          --override-filename="pkgs/servers/http/openresty/default.nix" \
+          --version="''${version}" \
+          openresty
+      '';
+    });
   };
 
   meta = {