diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index baec656fcae83..35bd7a3ba5a15 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -5,8 +5,8 @@
   linux,
   scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19812";
-    sha256 = "1bhkc0r5p3d4mmmi26k5lsk56jgbc8hi46bfih313hxmrnsd07dy";
+    rev = "19835";
+    hash = "sha256-5usyLmlTr5nlM+/uWPQepzhhNSLi3Hol1BfnWb9CFws=";
   },
   ...
 }@args:
@@ -30,16 +30,30 @@ linux.override {
     src = stdenv.mkDerivation {
       name = "${linux.name}-libre-src";
       src = linux.src;
+
       buildPhase = ''
+        runHook preBuild
+
         # --force flag to skip empty files after deblobbing
-        ${scripts}/${majorMinor}/deblob-${majorMinor} --force \
-            ${major} ${minor} ${patch}
+        ${scripts}/${majorMinor}/deblob-${majorMinor} --force ${major} ${minor} ${patch}
+
+        runHook postBuild
       '';
+
       checkPhase = ''
+        runHook preCheck
+
         ${scripts}/deblob-check
+
+        runHook postCheck
       '';
+
       installPhase = ''
+        runHook preInstall
+
         cp -r . "$out"
+
+        runHook postInstall
       '';
     };
 
diff --git a/pkgs/os-specific/linux/kernel/update-libre.sh b/pkgs/os-specific/linux/kernel/update-libre.sh
index aea12df55cc59..c1b98ee0d7b6b 100755
--- a/pkgs/os-specific/linux/kernel/update-libre.sh
+++ b/pkgs/os-specific/linux/kernel/update-libre.sh
@@ -6,7 +6,6 @@ nixpkgs="$(git rev-parse --show-toplevel)"
 path="$nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix"
 
 old_rev="$(grep -o 'rev = ".*"' "$path" | awk -F'"' '{print $2}')"
-old_sha256="$(grep -o 'sha256 = ".*"' "$path" | awk -F'"' '{print $2}')"
 
 svn_url=https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/
 rev="$(curl -s "$svn_url" | grep -Em 1 -o 'Revision [0-9]+' | awk '{print $2}')"
@@ -16,15 +15,16 @@ if [ "$old_rev" = "$rev" ]; then
     exit 0
 fi
 
+old_hash="$(grep -o 'hash = ".*"' "$path" | awk -F'"' '{print $2}')"
 sha256="$(QUIET=1 nix-prefetch-svn "$svn_url" "$rev" | tail -1)"
+new_hash="$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$sha256")"
 
-if [ "$old_sha256" = "$sha256" ]; then
+if [ "$old_hash" = "$new_hash" ]; then
     echo "No updates for linux-libre"
     exit 0
 fi
 
-sed -i -e "s/rev = \".*\"/rev = \"$rev\"/" \
-    -e "s/sha256 = \".*\"/sha256 = \"$sha256\"/" "$path"
+sed -i -e "s,rev = \".*\",rev = \"$rev\",; s,hash = \".*\",hash = \"$new_hash\"," "$path"
 
 if [ -n "${COMMIT-}" ]; then
     git commit -qm "linux_latest-libre: $old_rev -> $rev" "$path" \