diff --git a/pkgs/development/compilers/graalvm/community-edition/graaljs/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/graaljs/hashes.nix
index f8011bdfc257..861f128ece11 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graaljs/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graaljs/hashes.nix
@@ -1,18 +1,18 @@
 # Generated by update.sh script
 {
-  "version" = "25.0.3";
+  "version" = "25.2.4";
   "hashes" = {
-    "aarch64-darwin" = {
-      sha256 = "0yga0mkk6mnl8fw8agiazyd4ggyxm48wq18r0garpd46bdgm92s2";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graaljs-community-25.0.3-macos-aarch64.tar.gz";
-    };
     "aarch64-linux" = {
-      sha256 = "0g6hr73zq36wnm0fi03pg6ycad5ccjqav6wjrhzdkkq8x8mjy712";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graaljs-community-25.0.3-linux-aarch64.tar.gz";
+      sha256 = "0xj6h1sxawkg7ypxp7xmc99mzyh28q5wyzjcncr4bk9z47yd2ni3";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graaljs-community-25.2.4-linux-aarch64.tar.gz";
     };
     "x86_64-linux" = {
-      sha256 = "0naxhzwd2ikgxkyhajyqn3cg38y2wf8zcffwyw9ylvvddc167hdz";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graaljs-community-25.0.3-linux-amd64.tar.gz";
+      sha256 = "06lg9dyxxqbi4v1xnisjpy6n4w4als7xq312bm0gx2wz0b9j5d1c";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graaljs-community-25.2.4-linux-amd64.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "0kamd97f04n32fjxnhrjz5w3bn2gpai2sszss1682qrj2b3cgm4y";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graaljs-community-25.2.4-macos-aarch64.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalnodejs/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/graalnodejs/hashes.nix
index 2038d7ee88ba..7658ce07e4b7 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalnodejs/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalnodejs/hashes.nix
@@ -1,18 +1,18 @@
 # Generated by update.sh script
 {
-  "version" = "25.0.3";
+  "version" = "25.2.4";
   "hashes" = {
-    "aarch64-darwin" = {
-      sha256 = "11dwhbjdc683kryfqi2mpr2xc4nlhnx2k0sxgz3f7sgrxnvfpwsk";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graalnodejs-community-25.0.3-macos-aarch64.tar.gz";
-    };
     "aarch64-linux" = {
-      sha256 = "1lywl9qr5dmyjsp51zsk5mr1py7fyy1idlxbqf972a1fz9z35hw3";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graalnodejs-community-25.0.3-linux-aarch64.tar.gz";
+      sha256 = "0y5n2c3pz5fvrdmmi5iply1gk3wmvb7d7i33vrg1x0lbv0fbqjfv";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graalnode24-community-25.2.4-linux-aarch64.tar.gz";
     };
     "x86_64-linux" = {
-      sha256 = "1h3m0vyhfx2dw137czh3afm399idf4i013zg3b3k9zawcab77pwn";
-      url = "https://github.com/oracle/graaljs/releases/download/graal-25.0.3/graalnodejs-community-25.0.3-linux-amd64.tar.gz";
+      sha256 = "12jjgc1j51s9l5n0rz5grfh4d1px3gash1w19806mqa8wyxkj3nn";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graalnode24-community-25.2.4-linux-amd64.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "1wm7wdim18vaknkxnjgxg981dkpb6zr5qjwaq0i3j0fqlpq48sp8";
+      url = "https://github.com/oracle/graaljs/releases/download/graal-25.2.4/graalnode24-community-25.2.4-macos-aarch64.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
index acf48964ff6d..c7b86a5c8a47 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalpy/hashes.nix
@@ -1,18 +1,18 @@
 # Generated by update.sh script
 {
-  "version" = "25.0.3";
+  "version" = "25.2.4";
   "hashes" = {
-    "aarch64-darwin" = {
-      sha256 = "02nhy9srky7yasqxqc9pqa3cmsln0ln4k07jr47xdb0zslbyfm10";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-community-25.0.3-macos-aarch64.tar.gz";
-    };
     "aarch64-linux" = {
-      sha256 = "0kqd7a21wxrkmb6yqldz3g84zzdzh7blhda2dln5yligzqc761qy";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-community-25.0.3-linux-aarch64.tar.gz";
+      sha256 = "1xb4z42xc8962sz3ib8dg8h3fyp5xkdav2f1vs28259qidyfk9fx";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-25.2.4/graalpy3.12-community-25.2.4-linux-aarch64.tar.gz";
     };
     "x86_64-linux" = {
-      sha256 = "1pj9dmk2wpihsakzclmyb5jf4r4dhmdp55p04gyi6xv8ksiv0zz2";
-      url = "https://github.com/oracle/graalpython/releases/download/graal-25.0.3/graalpy-community-25.0.3-linux-amd64.tar.gz";
+      sha256 = "10mf20gs18v6rca1xmh6xzfj707pahr76m3k0wwxwjvidcx31bwq";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-25.2.4/graalpy3.12-community-25.2.4-linux-amd64.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "0yrmy4wczdf6h2m2x5vsccwmi2pcc4l6qrmr83v6kkk06rqq58bn";
+      url = "https://github.com/oracle/graalpython/releases/download/graal-25.2.4/graalpy3.12-community-25.2.4-macos-aarch64.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix b/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix
index a7a9c2308f9f..9ccd93b31a99 100644
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm-ce/hashes.nix
@@ -1,18 +1,18 @@
 # Generated by update.sh script
 {
-  "version" = "25.0.2";
+  "version" = "25.2.4";
   "hashes" = {
-    "aarch64-darwin" = {
-      sha256 = "0pv3c49va6vyvx2lzj305ss39mkaddx8fmfrafifflz6x2w1y82h";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_macos-aarch64_bin.tar.gz";
-    };
     "aarch64-linux" = {
-      sha256 = "0waa7395f53lrg2my43ywr8bj7aczwc8prap2wx4n2ix4aghsn5l";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_linux-aarch64_bin.tar.gz";
+      sha256 = "1drhs99b8jfxycpf34f4xwzbvqb9fiwvzf966bdsxf91rmz6ya12";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_linux-aarch64_bin.tar.gz";
     };
     "x86_64-linux" = {
-      sha256 = "1w3ac0cl9d2ja98klyq5f1hp6j9ixx7q5jx0n2v06kfsiwf7kgp0";
-      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-25.0.2/graalvm-community-jdk-25.0.2_linux-x64_bin.tar.gz";
+      sha256 = "0bll9f61nk1rnpw3fdddg93dhb47gry9a2bzcznz55maivg8jjiz";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_linux-x64_bin.tar.gz";
+    };
+    "aarch64-darwin" = {
+      sha256 = "1yivvlxghh2gb62f2394ih6rpylilhhmmj91hqdyazchz3zk0wsh";
+      url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/graal-25.2.4/graalvm-community-jdk-25i2-25.0.4_macos-aarch64_bin.tar.gz";
     };
   };
 }
diff --git a/pkgs/development/compilers/graalvm/community-edition/update.sh b/pkgs/development/compilers/graalvm/community-edition/update.sh
index 88c233e6d20f..20a4bdd65892 100755
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@@ -23,6 +23,8 @@ trap 'rm -rf "$tmpfile"' EXIT
 
 info() { echo "[INFO] $*"; }
 
+die() { echo "[ERROR] $*" >&2; exit 1; }
+
 echo_file() { echo "$@" >> "$tmpfile"; }
 
 verlte() {
@@ -35,45 +37,101 @@ readonly nixpkgs=../../../../..
 
 mkdir -p "$product"
 
-declare -r -A update_urls=(
-  [graalvm-ce]="https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest"
-  [graaljs]="https://api.github.com/repos/oracle/graaljs/releases/latest"
-  [graalnodejs]="https://api.github.com/repos/oracle/graaljs/releases/latest"
-  [graalpy]="https://api.github.com/repos/oracle/graalpython/releases/latest"
-  [truffleruby]="https://api.github.com/repos/truffleruby/truffleruby/releases/latest"
+declare -r -A repos=(
+  [graalvm-ce]="graalvm/graalvm-ce-builds"
+  [graaljs]="oracle/graaljs"
+  [graalnodejs]="oracle/graaljs"
+  [graalpy]="oracle/graalpython"
+  [truffleruby]="truffleruby/truffleruby"
 )
+readonly repo="${repos[$product]}"
+
+auth_args=()
+if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+  auth_args+=(-u ":${GITHUB_TOKEN}")
+fi
+
+api_url() { echo "https://api.github.com/repos/${repo}/$1"; }
+
+# Unauthenticated requests are capped at 60/hour, so a rate limit is the most
+# likely failure here. `-f` discards the response body, so without an explicit
+# `die` the script would abort under `set -e` printing nothing at all.
+gh_api() {
+  curl -fsS "${auth_args[@]}" "$(api_url "$1")" \
+    || die "GitHub API request for '${repo}/$1' failed. Set GITHUB_TOKEN if you are being rate limited."
+}
+
+gh_status() { curl -sS -o /dev/null -w '%{http_code}' "${auth_args[@]}" "$(api_url "$1")"; }
 
 current_version="$(nix-instantiate "$nixpkgs" --eval --strict -A "graalvmPackages.${product}.version" --json | jq -r)"
 readonly current_version
 
+# Releases are tagged `jdk-<version>` up to 25.0.2 and `graal-<version>` from
+# the 25.1 innovation stream on, so an explicit VERSION has to try both. Check
+# the status code rather than curl's exit status, so that a tag which does not
+# exist is not reported the same way as a rate limit.
+resolve_tag() {
+  local candidate code
+  for candidate in "graal-$1" "jdk-$1"; do
+    code="$(gh_status "releases/tags/${candidate}")"
+    case "$code" in
+      200)
+        echo "$candidate"
+        return 0
+        ;;
+      404) ;;
+      *) die "GitHub API returned HTTP $code for tag '$candidate'. Set GITHUB_TOKEN if you are being rate limited." ;;
+    esac
+  done
+  die "Neither 'graal-$1' nor 'jdk-$1' is a release of '$repo'."
+}
+
+# `releases/latest` already carries the asset list, so read the tag out of it
+# instead of asking for the same release a second time.
 if [[ -z "${VERSION:-}" ]]; then
-  gh_version="$(curl \
-      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
-      -s "${update_urls[$product]}" | \
-      jq --raw-output .tag_name)"
-  new_version="${gh_version//jdk-/}"
-  new_version="${new_version//graal-/}"
+  release_json="$(gh_api releases/latest)"
+  tag="$(jq --raw-output .tag_name <<< "$release_json")"
 else
-  new_version="$VERSION"
+  tag="$(resolve_tag "$VERSION")"
+  release_json="$(gh_api "releases/tags/${tag}")"
 fi
+readonly release_json tag
+new_version="${tag//jdk-/}"
+new_version="${new_version//graal-/}"
 readonly new_version
 
 info "Current version: $current_version"
 info "New version: $new_version"
 if verlte "$new_version" "$current_version"; then
+  if [[ "$new_version" != "$current_version" ]]; then
+    # A `jdk-25.0.x` release published after `graal-25.2.4` sorts lower than the
+    # packaged version, so it would silently look up-to-date. Say so instead.
+    info "WARNING: upstream '$tag' sorts below the packaged $current_version."
+    info "WARNING: upstream may have switched release trains. Check manually."
+  fi
   info "$product $current_version is up-to-date."
-  [[ -z "${FORCE:-}" ]]  && exit 0
+  if [[ -z "${FORCE:-}" ]]; then
+    exit 0
+  fi
 else
   info "$product $current_version is out-of-date. Updating..."
 fi
 
-# Make sure to get the `-community` versions!
-declare -r -A products_urls=(
-  [graalvm-ce]="https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${new_version}/graalvm-community-jdk-${new_version}_@platform@_bin.tar.gz"
-  [graaljs]="https://github.com/oracle/graaljs/releases/download/graal-${new_version}/graaljs-community-${new_version}-@platform@.tar.gz"
-  [graalnodejs]="https://github.com/oracle/graaljs/releases/download/graal-${new_version}/graalnodejs-community-${new_version}-@platform@.tar.gz"
-  [graalpy]="https://github.com/oracle/graalpython/releases/download/graal-${new_version}/graalpy-community-${new_version}-@platform@.tar.gz"
-  [truffleruby]="https://github.com/truffleruby/truffleruby/releases/download/graal-${new_version}/truffleruby-community-${new_version}-@platform@.tar.gz"
+# Make sure to get the `-community` versions! The file names cannot be built
+# from the GraalVM version alone, because they embed a component version it
+# does not give us: graalvm-community-jdk-25i2-25.0.4, graalnode24,
+# graalpy3.12. Match the release's own asset list instead. Anchoring the
+# version right after `-community-` also excludes the `-jvm-` variants.
+# graalvm-ce cannot be anchored that way, because its file name carries the
+# JDK version and not the GraalVM one, so the match below has to be checked
+# for ambiguity.
+readonly version_re="${new_version//./\\.}"
+declare -r -A asset_patterns=(
+  [graalvm-ce]="^graalvm-community-jdk-.*_@platform@_bin\\.tar\\.gz$"
+  [graaljs]="^graaljs-community-${version_re}-@platform@\\.tar\\.gz$"
+  [graalnodejs]="^graalnode(js|[0-9]+)-community-${version_re}-@platform@\\.tar\\.gz$"
+  [graalpy]="^graalpy[0-9.]*-community-${version_re}-@platform@\\.tar\\.gz$"
+  [truffleruby]="^truffleruby-community-${version_re}-@platform@\\.tar\\.gz$"
 )
 
 # Argh, this is really inconsistent...
@@ -97,11 +155,26 @@ info "Generating '$hashes_nix' file for '$product' $new_version. This will take
 echo_file "# Generated by $(basename $0) script"
 echo_file "{"
 echo_file "  \"version\" = \"$new_version\";"
-url="${products_urls["${product}"]}"
+readonly pattern="${asset_patterns[$product]}"
 echo_file "  \"hashes\" = {"
 for nix_platform in "${!platforms[@]}"; do
   product_platform="${platforms[$nix_platform]}"
-  args=("${url//@platform@/$product_platform}")
+  asset_re="${pattern//@platform@/$product_platform}"
+  mapfile -t urls < <(jq --raw-output --arg re "$asset_re" \
+    '.assets[] | select(.name | test($re)) | .browser_download_url' \
+    <<< "$release_json")
+  # Never skip a platform, and never guess between candidates. meta.platforms is
+  # derived from the attribute names in hashes.nix, so dropping one here silently
+  # removes it from the package; and vm-22.3.1 shipped java11, java17 and java19
+  # assets side by side, so taking the first match could pin a different JDK per
+  # platform.
+  if ((${#urls[@]} == 0)); then
+    die "No asset matches '$asset_re' in release '$tag'. Upstream naming has probably changed; fix asset_patterns[$product] rather than losing $nix_platform."
+  elif ((${#urls[@]} > 1)); then
+    die "${#urls[@]} assets match '$asset_re' in release '$tag': ${urls[*]}. Make asset_patterns[$product] more specific."
+  fi
+  url="${urls[0]}"
+  args=("$url")
   # Get current hashes to skip derivations already in /nix/store to reuse cache when the version is the same
   # e.g.: when adding a new product and running this script with FORCE=1
   if [[ "$current_version" == "$new_version" ]] && \
@@ -110,14 +183,13 @@ for nix_platform in "${!platforms[@]}"; do
   else
       info "Hash in '$product' for '$nix_platform' not found. Re-downloading it..."
   fi
-  if hash="$(nix-prefetch-url "${args[@]}")"; then
+  if ! hash="$(nix-prefetch-url "${args[@]}")"; then
+    die "Could not download '$url' for '$nix_platform'."
+  fi
 echo_file "    \"$nix_platform\" = {"
 echo_file "      sha256 = \"$hash\";"
-echo_file "      url = \"${url//@platform@/${product_platform}}\";"
+echo_file "      url = \"${url}\";"
 echo_file "    };"
-  else
-      info "Error while downloading '$product' for '$nix_platform'. Skipping it..."
-  fi
 done
 echo_file "  };"
 echo_file "}"