diff --git a/pkgs/applications/networking/cluster/fluxcd/update.sh b/pkgs/applications/networking/cluster/fluxcd/update.sh
index 8c80ef9fda3..f252d587daa 100755
--- a/pkgs/applications/networking/cluster/fluxcd/update.sh
+++ b/pkgs/applications/networking/cluster/fluxcd/update.sh
@@ -21,16 +21,17 @@ if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
     setKV version ${LATEST_VERSION}
     setKV sha256 ${SHA256}
     setKV manifestsSha256 ${SPEC_SHA256}
-    setKV vendorSha256 "0000000000000000000000000000000000000000000000000000" # The same as lib.fakeSha256
+    setKV vendorHash "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" # The same as lib.fakeHash
 
     set +e
-    VENDOR_SHA256=$(nix-build --no-out-link -A fluxcd $NIXPKGS_PATH 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
+    VENDOR_HASH=$(nix-build --no-out-link -A fluxcd $NIXPKGS_PATH 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
+    VENDOR_HASH=$(nix hash to-sri --type sha256 $VENDOR_HASH)
     set -e
 
-    if [ -n "${VENDOR_SHA256:-}" ]; then
-        setKV vendorSha256 ${VENDOR_SHA256}
+    if [ -n "${VENDOR_HASH:-}" ]; then
+        setKV vendorHash ${VENDOR_HASH}
     else
-        echo "Update failed. VENDOR_SHA256 is empty."
+        echo "Update failed. VENDOR_HASH is empty."
         exit 1
     fi