diff --git a/pkgs/servers/invidious/default.nix b/pkgs/servers/invidious/default.nix
index 64ecba5cc88..14eed9a3be7 100644
--- a/pkgs/servers/invidious/default.nix
+++ b/pkgs/servers/invidious/default.nix
@@ -8,17 +8,16 @@ let
   #  * shards.nix (by running `crystal2nix` in invidious’ source tree)
   #  * If the lsquic.cr dependency changed: lsquic in lsquic.nix (version, sha256)
   #  * If the lsquic version changed: boringssl' in lsquic.nix (version, sha256)
-  rev = "081fd541afc9b2f9b821e0f8f4c66dda0839295c";
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
 in
 crystal.buildCrystalPackage rec {
   pname = "invidious";
-  version = "unstable-2022-02-25";
+  inherit (versions.invidious) version;
 
   src = fetchFromGitHub {
     owner = "iv-org";
     repo = pname;
-    inherit rev;
-    sha256 = "12m1fd8yfs6fqchvf9masr837dcghsg5x2nb8vcpzakzia5qc2kf";
+    inherit (versions.invidious) rev sha256;
   };
 
   postPatch =
@@ -39,9 +38,9 @@ crystal.buildCrystalPackage rec {
       # build-time
       substituteInPlace src/invidious.cr \
           --replace ${lib.escapeShellArg branchTemplate} '"master"' \
-          --replace ${lib.escapeShellArg commitTemplate} '"${lib.substring 0 7 rev}"' \
+          --replace ${lib.escapeShellArg commitTemplate} '"${lib.substring 0 7 versions.invidious.rev}"' \
           --replace ${lib.escapeShellArg versionTemplate} '"${lib.replaceChars ["-"] ["."] (lib.substring 9 10 version)}"' \
-          --replace ${lib.escapeShellArg assetCommitTemplate} '"${lib.substring 0 7 rev}"'
+          --replace ${lib.escapeShellArg assetCommitTemplate} '"${lib.substring 0 7 versions.invidious.rev}"'
 
       # Patch the assets and locales paths to be absolute
       substituteInPlace src/invidious.cr \
diff --git a/pkgs/servers/invidious/lsquic.nix b/pkgs/servers/invidious/lsquic.nix
index fbef8805bb5..08df5b4a1d1 100644
--- a/pkgs/servers/invidious/lsquic.nix
+++ b/pkgs/servers/invidious/lsquic.nix
@@ -1,12 +1,13 @@
 { lib, boringssl, stdenv, fetchgit, fetchFromGitHub, cmake, zlib, perl, libevent }:
 let
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
+
   # lsquic requires a specific boringssl version (noted in its README)
-  boringssl' = boringssl.overrideAttrs (old: rec {
-    version = "251b5169fd44345f455438312ec4e18ae07fd58c";
+  boringssl' = boringssl.overrideAttrs (old: {
+    version = versions.boringssl.rev;
     src = fetchgit {
       url = "https://boringssl.googlesource.com/boringssl";
-      rev = version;
-      sha256 = "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A=";
+      inherit (versions.boringssl) rev sha256;
     };
 
     patches = [
@@ -17,13 +18,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "lsquic";
-  version = "2.18.1";
+  version = versions.lsquic.version;
 
   src = fetchFromGitHub {
     owner = "litespeedtech";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=";
+    inherit (versions.lsquic) sha256;
     fetchSubmodules = true;
   };
 
@@ -54,6 +55,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.boringssl = boringssl';
+
   meta = with lib; {
     description = "A library for QUIC and HTTP/3 (version for Invidious)";
     homepage = "https://github.com/litespeedtech/lsquic";
diff --git a/pkgs/servers/invidious/update.sh b/pkgs/servers/invidious/update.sh
index bb85a7ba2ae..580d6136388 100755
--- a/pkgs/servers/invidious/update.sh
+++ b/pkgs/servers/invidious/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p common-updater-scripts curl crystal crystal2nix jq git gnused nix nix-prefetch-git nix-update pkg-config
+#!nix-shell -i bash -p curl crystal crystal2nix jq git moreutils nix nix-prefetch pkg-config
 git_url='https://github.com/iv-org/invidious.git'
 git_branch='master'
 git_dir='/var/tmp/invidious.git'
@@ -7,6 +7,8 @@ pkg='invidious'
 
 set -euo pipefail
 
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
 info() {
     if [ -t 2 ]; then
         set -- '\033[32m%s\033[39m\n' "$@"
@@ -16,8 +18,16 @@ info() {
     printf "$@" >&2
 }
 
-old_rev=$(nix-instantiate --eval --strict --json -A "$pkg.src.rev" | jq -r)
-old_version=$(nix-instantiate --eval --strict --json -A "$pkg.version" | jq -r)
+json_get() {
+    jq -r "$1" < 'versions.json'
+}
+
+json_set() {
+    jq --arg x "$2" "$1 = \$x" < 'versions.json' | sponge 'versions.json'
+}
+
+old_rev=$(json_get '.invidious.rev')
+old_version=$(json_get '.invidious.version')
 today=$(LANG=C date -u +'%Y-%m-%d')
 
 info "fetching $git_url..."
@@ -39,22 +49,19 @@ if [ "$new_rev" = "$old_rev" ]; then
     exit
 fi
 
-new_sha256=$(nix-prefetch-git --rev "$new_rev" "$git_dir" | jq -r .sha256)
-update-source-version "$pkg" \
-    "$new_version" \
-    "$new_sha256" \
-    --rev="$new_rev"
+json_set '.invidious.version' "$new_version"
+json_set '.invidious.rev' "$new_rev"
+new_sha256=$(nix-prefetch -I 'nixpkgs=../../..' "$pkg")
+json_set '.invidious.sha256' "$new_sha256"
 commit_msg="$pkg: $old_version -> $new_version"
 
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
 # fetch video.js dependencies
 info "Running scripts/fetch-player-dependencies.cr..."
 git -C "$git_dir" reset --hard "$new_rev"
 (cd "$git_dir" && crystal run scripts/fetch-player-dependencies.cr -- --minified)
 rm -f "$git_dir/assets/videojs/.gitignore"
 videojs_new_sha256=$(nix hash-path --type sha256 --base32 "$git_dir/assets/videojs")
-sed -e "s,\boutputHash = .*,outputHash = \"$videojs_new_sha256\";," -i 'videojs.nix'
+json_set '.videojs.sha256' "$videojs_new_sha256"
 
 if git -C "$git_dir" diff-tree --quiet "${old_rev}..${new_rev}" -- 'shard.lock'; then
     info "shard.lock did not change since $old_rev."
@@ -62,27 +69,28 @@ else
     info "Updating shards.nix..."
     crystal2nix -- "$git_dir/shard.lock"  # argv's index seems broken
 
-    lsquic_old_version=$(nix-instantiate --eval --strict --json -A "${pkg}.lsquic.version" '../../..' | jq -r)
+    lsquic_old_version=$(json_get '.lsquic.version')
+    # lsquic.cr's version tracks lsquic's, so lsquic must be updated to the
+    # version in the shards file
     lsquic_new_version=$(nix eval --raw -f 'shards.nix' lsquic.rev \
         | sed -e 's/^v//' -e 's/-[0-9]*$//')
     if [ "$lsquic_old_version" != "$lsquic_new_version" ]; then
         info "Updating lsquic to $lsquic_new_version..."
-        nix-update --version "$lsquic_new_version" -f '../../..' invidious.lsquic
-        if git diff-index --quiet HEAD -- 'lsquic.nix'; then
-            info "lsquic is up-to-date."
-        else
-            boringssl_new_version=$(curl -LSsf "https://github.com/litespeedtech/lsquic/raw/v${lsquic_new_version}/README.md" \
-                | grep -Pom1 '(?<=^git checkout ).*')
-            boringssl_new_sha256=$(nix-prefetch-git --rev "$boringssl_new_version" 'https://boringssl.googlesource.com/boringssl' \
-                | jq -r .sha256)
-            sed -e "0,/^ *version = .*/ s//    version = \"$boringssl_new_version\";/" \
-                -e "0,/^ *sha256 = .*/ s//      sha256 = \"$boringssl_new_sha256\";/" \
-                -i 'lsquic.nix'
-            commit_msg="$commit_msg
+        json_set '.lsquic.version' "$lsquic_new_version"
+        lsquic_new_sha256=$(nix-prefetch -I 'nixpkgs=../../..' "${pkg}.lsquic")
+        json_set '.lsquic.sha256' "$lsquic_new_sha256"
+
+        info "Updating boringssl..."
+        # lsquic specifies the boringssl commit it requires in its README
+        boringssl_new_rev=$(curl -LSsf "https://github.com/litespeedtech/lsquic/raw/v${lsquic_new_version}/README.md" \
+            | grep -Pom1 '(?<=^git checkout ).*')
+        json_set '.boringssl.rev' "$boringssl_new_rev"
+        boringssl_new_sha256=$(nix-prefetch -I 'nixpkgs=../../..' "${pkg}.lsquic.boringssl")
+        json_set '.boringssl.sha256' "$boringssl_new_sha256"
+        commit_msg="$commit_msg
 
 lsquic: $lsquic_old_version -> $lsquic_new_version"
-        fi
     fi
 fi
 
-git commit --verbose --message "$commit_msg" *.nix
+git commit --verbose --message "$commit_msg" -- versions.json shards.nix
diff --git a/pkgs/servers/invidious/versions.json b/pkgs/servers/invidious/versions.json
new file mode 100644
index 00000000000..46d3c174078
--- /dev/null
+++ b/pkgs/servers/invidious/versions.json
@@ -0,0 +1,18 @@
+{
+  "boringssl": {
+    "rev": "251b5169fd44345f455438312ec4e18ae07fd58c",
+    "sha256": "sha256-EU6T9yQCdOLx98Io8o01rEsgxDFF/Xoy42LgPopD2/A="
+  },
+  "invidious": {
+    "rev": "081fd541afc9b2f9b821e0f8f4c66dda0839295c",
+    "sha256": "12m1fd8yfs6fqchvf9masr837dcghsg5x2nb8vcpzakzia5qc2kf",
+    "version": "unstable-2022-02-25"
+  },
+  "lsquic": {
+    "sha256": "sha256-hG8cUvhbCNeMOsKkaJlgGpzUrIx47E/WhmPIdI5F3qM=",
+    "version": "2.18.1"
+  },
+  "videojs": {
+    "sha256": "0b4vxd29kpvy60yhqm376r1872gds17s6wljqw0zlr16j762k50r"
+  }
+}
diff --git a/pkgs/servers/invidious/videojs.nix b/pkgs/servers/invidious/videojs.nix
index 07358ad761b..e4470793e51 100644
--- a/pkgs/servers/invidious/videojs.nix
+++ b/pkgs/servers/invidious/videojs.nix
@@ -1,5 +1,8 @@
 { stdenvNoCC, cacert, crystal, openssl, pkg-config, invidious }:
 
+let
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
+in
 stdenvNoCC.mkDerivation {
   name = "videojs";
 
@@ -11,5 +14,5 @@ stdenvNoCC.mkDerivation {
 
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
-  outputHash = "0b4vxd29kpvy60yhqm376r1872gds17s6wljqw0zlr16j762k50r";
+  outputHash = versions.videojs.sha256;
 }