diff --git a/justfile b/justfile
index c1909ef..1b7bcdb 100644
--- a/justfile
+++ b/justfile
@@ -17,6 +17,14 @@ update:
 # update flake inputs, rebuild and switch
 bump: update switch
 
+# update a package to latest version
+update-package pkg:
+    bash packages/{{pkg}}/update.sh
+
+# update all packages with update scripts
+update-package-all:
+    @for script in packages/*/update.sh; do bash "$script"; done
+
 # build installation iso
 iso:
     nixos-rebuild build-image --image-variant iso-installer --flake .#live-iso
diff --git a/lib/autoDir.nix b/lib/autoDir.nix
index 920637a..e6ec13b 100644
--- a/lib/autoDir.nix
+++ b/lib/autoDir.nix
@@ -1,15 +1,10 @@
 lib:
 
-# import all .nix files in dir as attribute set
+# import package.nix from each subdirectory in dir as attribute set
 dir:
 let
   readDir = builtins.readDir dir;
-  files = lib.attrNames (
-    lib.filterAttrs (
-      name: type: type == "regular" && lib.hasSuffix ".nix" name && name != "default.nix"
-    ) readDir
-  );
-
-  packages = builtins.map (name: lib.removeSuffix ".nix" name) files;
+  dirs = lib.attrNames (lib.filterAttrs (_: type: type == "directory") readDir);
+  packages = lib.filter (name: builtins.pathExists (dir + "/${name}/package.nix")) dirs;
 in
-lib.genAttrs packages (name: import (dir + "/${name}.nix"))
+lib.genAttrs packages (name: import (dir + "/${name}/package.nix"))
diff --git a/packages/ahab.nix b/packages/ahab/package.nix
similarity index 100%
rename from packages/ahab.nix
rename to packages/ahab/package.nix
diff --git a/packages/ahab/update.sh b/packages/ahab/update.sh
new file mode 100755
index 0000000..ae8ebb8
--- /dev/null
+++ b/packages/ahab/update.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-prefetch
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+cd "$ROOT_DIR"
+
+extract_hash() {
+  sed 's/\x1b\[[0-9;]*m//g' | grep 'got:' | tail -1 | grep -oP 'sha256-[A-Za-z0-9+/]+='
+}
+
+echo "fetching latest version..."
+LATEST=$(curl -sf "https://git.janezic.dev/api/v1/repos/janezicmatej/ahab/tags?limit=1" | jq -r '.[0].name')
+CURRENT=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+if [[ "$CURRENT" == "$LATEST" ]]; then
+  echo "ahab already at $LATEST"
+  exit 0
+fi
+
+echo "updating ahab: $CURRENT -> $LATEST"
+
+echo "  prefetching source..."
+BASE32=$(nix-prefetch-url --unpack "https://git.janezic.dev/janezicmatej/ahab/archive/${LATEST}.tar.gz" 2>/dev/null)
+SRC_HASH=$(nix hash convert --to sri "sha256:$BASE32")
+echo "  source: $SRC_HASH"
+
+echo "  computing cargo hash..."
+BUILD_OUTPUT=$(nix build --no-link --impure --expr "
+  let
+    pkgs = (builtins.getFlake \"path:$ROOT_DIR\").inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
+  in pkgs.rustPlatform.fetchCargoVendor {
+    src = pkgs.fetchFromGitea {
+      domain = \"git.janezic.dev\";
+      owner = \"janezicmatej\";
+      repo = \"ahab\";
+      rev = \"$LATEST\";
+      hash = \"$SRC_HASH\";
+    };
+    hash = \"\";
+  }
+" 2>&1) || true
+CARGO_HASH=$(echo "$BUILD_OUTPUT" | extract_hash) || true
+
+if [[ -z "$CARGO_HASH" ]]; then
+  echo "  error: failed to compute cargo hash"
+  echo "$BUILD_OUTPUT"
+  exit 1
+fi
+echo "  cargo: $CARGO_HASH"
+
+OLD_SRC=$(grep 'sha256 = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+OLD_CARGO=$(grep 'cargoHash = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+
+sed -i "s|version = \"$CURRENT\"|version = \"$LATEST\"|" "$PKG_FILE"
+sed -i "s|$OLD_SRC|$SRC_HASH|" "$PKG_FILE"
+sed -i "s|$OLD_CARGO|$CARGO_HASH|" "$PKG_FILE"
+
+echo "ahab updated to $LATEST"
diff --git a/packages/ca-matheo-si.nix b/packages/ca-matheo-si/package.nix
similarity index 100%
rename from packages/ca-matheo-si.nix
rename to packages/ca-matheo-si/package.nix
diff --git a/packages/ggman.nix b/packages/ggman/package.nix
similarity index 100%
rename from packages/ggman.nix
rename to packages/ggman/package.nix
diff --git a/packages/ggman/update.sh b/packages/ggman/update.sh
new file mode 100755
index 0000000..c4909ad
--- /dev/null
+++ b/packages/ggman/update.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-prefetch
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+cd "$ROOT_DIR"
+
+extract_hash() {
+  sed 's/\x1b\[[0-9;]*m//g' | grep 'got:' | tail -1 | grep -oP 'sha256-[A-Za-z0-9+/]+='
+}
+
+echo "fetching latest tag..."
+LATEST=$(curl -sf "https://api.github.com/repos/tkw1536/ggman/tags?per_page=1" | jq -r '.[0].name')
+CURRENT=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+if [[ "$CURRENT" == "$LATEST" ]]; then
+  echo "ggman already at $LATEST"
+  exit 0
+fi
+
+echo "updating ggman: $CURRENT -> $LATEST"
+
+echo "  prefetching source..."
+BASE32=$(nix-prefetch-url --unpack "https://github.com/tkw1536/ggman/archive/${LATEST}.tar.gz" 2>/dev/null)
+SRC_HASH=$(nix hash convert --to sri "sha256:$BASE32")
+echo "  source: $SRC_HASH"
+
+echo "  computing vendor hash..."
+BUILD_OUTPUT=$(nix build --no-link --impure --expr "
+  let
+    pkgs = (builtins.getFlake \"path:$ROOT_DIR\").inputs.nixpkgs-master.legacyPackages.\${builtins.currentSystem};
+  in (pkgs.buildGoModule.override { go = pkgs.go_1_26; } {
+    pname = \"ggman\";
+    version = \"$LATEST\";
+    src = pkgs.fetchFromGitHub {
+      owner = \"tkw1536\";
+      repo = \"ggman\";
+      rev = \"$LATEST\";
+      hash = \"$SRC_HASH\";
+    };
+    vendorHash = \"\";
+  }).goModules
+" 2>&1) || true
+VENDOR_HASH=$(echo "$BUILD_OUTPUT" | extract_hash) || true
+
+if [[ -z "$VENDOR_HASH" ]]; then
+  echo "  error: failed to compute vendor hash"
+  echo "$BUILD_OUTPUT"
+  exit 1
+fi
+echo "  vendor: $VENDOR_HASH"
+
+OLD_SRC=$(grep 'sha256 = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+OLD_VENDOR=$(grep 'vendorHash = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+
+sed -i "s|version = \"$CURRENT\"|version = \"$LATEST\"|" "$PKG_FILE"
+sed -i "s|$OLD_SRC|$SRC_HASH|" "$PKG_FILE"
+sed -i "s|$OLD_VENDOR|$VENDOR_HASH|" "$PKG_FILE"
+
+echo "ggman updated to $LATEST"
diff --git a/packages/git-linearize.nix b/packages/git-linearize/package.nix
similarity index 100%
rename from packages/git-linearize.nix
rename to packages/git-linearize/package.nix
diff --git a/packages/todo-mcp.nix b/packages/todo-mcp/package.nix
similarity index 100%
rename from packages/todo-mcp.nix
rename to packages/todo-mcp/package.nix
diff --git a/packages/todo-mcp/update.sh b/packages/todo-mcp/update.sh
new file mode 100755
index 0000000..7314b8e
--- /dev/null
+++ b/packages/todo-mcp/update.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix-prefetch
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+PKG_FILE="$SCRIPT_DIR/package.nix"
+
+cd "$ROOT_DIR"
+
+extract_hash() {
+  sed 's/\x1b\[[0-9;]*m//g' | grep 'got:' | tail -1 | grep -oP 'sha256-[A-Za-z0-9+/]+='
+}
+
+echo "fetching latest version..."
+LATEST=$(curl -sf "https://git.janezic.dev/api/v1/repos/janezicmatej/todo-mcp/tags?limit=1" | jq -r '.[0].name')
+CURRENT=$(grep 'version = ' "$PKG_FILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+if [[ "$CURRENT" == "$LATEST" ]]; then
+  echo "todo-mcp already at $LATEST"
+  exit 0
+fi
+
+echo "updating todo-mcp: $CURRENT -> $LATEST"
+
+echo "  prefetching source..."
+BASE32=$(nix-prefetch-url --unpack "https://git.janezic.dev/janezicmatej/todo-mcp/archive/${LATEST}.tar.gz" 2>/dev/null)
+SRC_HASH=$(nix hash convert --to sri "sha256:$BASE32")
+echo "  source: $SRC_HASH"
+
+echo "  computing cargo hash..."
+BUILD_OUTPUT=$(nix build --no-link --impure --expr "
+  let
+    pkgs = (builtins.getFlake \"path:$ROOT_DIR\").inputs.nixpkgs.legacyPackages.\${builtins.currentSystem};
+  in pkgs.rustPlatform.fetchCargoVendor {
+    src = pkgs.fetchFromGitea {
+      domain = \"git.janezic.dev\";
+      owner = \"janezicmatej\";
+      repo = \"todo-mcp\";
+      rev = \"$LATEST\";
+      hash = \"$SRC_HASH\";
+    };
+    hash = \"\";
+  }
+" 2>&1) || true
+CARGO_HASH=$(echo "$BUILD_OUTPUT" | extract_hash) || true
+
+if [[ -z "$CARGO_HASH" ]]; then
+  echo "  error: failed to compute cargo hash"
+  echo "$BUILD_OUTPUT"
+  exit 1
+fi
+echo "  cargo: $CARGO_HASH"
+
+OLD_SRC=$(grep 'sha256 = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+OLD_CARGO=$(grep 'cargoHash = ' "$PKG_FILE" | grep -oP 'sha256-[A-Za-z0-9+/]+=')
+
+sed -i "s|version = \"$CURRENT\"|version = \"$LATEST\"|" "$PKG_FILE"
+sed -i "s|$OLD_SRC|$SRC_HASH|" "$PKG_FILE"
+sed -i "s|$OLD_CARGO|$CARGO_HASH|" "$PKG_FILE"
+
+echo "todo-mcp updated to $LATEST"