diff --git a/.gitea/scripts/update-ocenaudio-nix.sh b/.gitea/scripts/update-ocenaudio-nix.sh
new file mode 100755
index 0000000..34a35b8
--- /dev/null
+++ b/.gitea/scripts/update-ocenaudio-nix.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${FILE:?FILE is required}"
+
+if command -v python >/dev/null 2>&1; then
+  PYTHON_BIN=python
+elif command -v python3 >/dev/null 2>&1; then
+  PYTHON_BIN=python3
+else
+  echo "python is required but was not found"
+  exit 1
+fi
+
+current_version=$($PYTHON_BIN - <<'PY'
+import re
+import os
+p=os.environ["FILE"]
+s=open(p).read()
+m=re.search(r'version\s*=\s*"([^"]+)";', s)
+print(m.group(1) if m else "")
+PY
+)
+
+page=$(curl -fsSL https://www.ocenaudio.com/download)
+latest_version=$(printf '%s' "$page" | "$PYTHON_BIN" -c 'import re,sys; s=sys.stdin.read(); m=re.search(r"ocenaudio_debian12\.deb</p>\s*<p>Versão ([0-9.]+)</p>", s); print(m.group(1) if m else "")')
+
+if [ -z "$latest_version" ]; then
+  echo "failed to detect latest ocenaudio version"
+  exit 1
+fi
+
+echo "current=$current_version"
+echo "latest=$latest_version"
+
+if [ "$latest_version" = "$current_version" ]; then
+  echo "updated=false" >> "$GITHUB_OUTPUT"
+  exit 0
+fi
+
+download_url="https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian12.deb?version=v${latest_version}"
+new_hash=$(nix store prefetch-file --json "$download_url" | "$PYTHON_BIN" -c 'import json,sys; print(json.load(sys.stdin)["hash"])')
+
+export LATEST_VERSION="$latest_version"
+export NEW_HASH="$new_hash"
+
+"$PYTHON_BIN" - <<'PY'
+import os
+import re
+p=os.environ["FILE"]
+s=open(p).read()
+s=re.sub(r'version\s*=\s*"[^"]+";', f'version = "{os.environ["LATEST_VERSION"]}";', s, count=1)
+s=re.sub(r'hash\s*=\s*"[^"]+";', f'hash = "{os.environ["NEW_HASH"]}";', s, count=1)
+open(p, "w").write(s)
+PY
+
+echo "updated=true" >> "$GITHUB_OUTPUT"
+echo "version=$latest_version" >> "$GITHUB_OUTPUT"
+echo "previous_version=$current_version" >> "$GITHUB_OUTPUT"
+echo "release_url=https://www.ocenaudio.com/changelog" >> "$GITHUB_OUTPUT"
diff --git a/.gitea/workflows/ocenaudio-update.yml b/.gitea/workflows/ocenaudio-update.yml
new file mode 100644
index 0000000..4c9e7bc
--- /dev/null
+++ b/.gitea/workflows/ocenaudio-update.yml
@@ -0,0 +1,41 @@
+name: ocenaudio update
+
+on:
+  schedule:
+    - cron: "30 3 * * *" # UTC
+  workflow_dispatch:
+
+jobs:
+  update-ocenaudio:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ocenaudio-update
+      cancel-in-progress: false
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: install nix
+        uses: cachix/install-nix-action@v27
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: check latest ocenaudio release and update file
+        id: update
+        env:
+          FILE: modules/pkgs/ocenaudio.nix
+        shell: bash
+        run: bash .gitea/scripts/update-ocenaudio-nix.sh
+
+      - name: commit and push to main
+        if: steps.update.outputs.updated == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          version="${{ steps.update.outputs.version }}"
+
+          FILE="modules/pkgs/ocenaudio.nix" \
+          COMMIT_MESSAGE="update ocenaudio to ${version}" \
+          bash .gitea/scripts/commit-update-main.sh
diff --git a/modules/pkgs/ocenaudio.nix b/modules/pkgs/ocenaudio.nix
new file mode 100644
index 0000000..eb55c19
--- /dev/null
+++ b/modules/pkgs/ocenaudio.nix
@@ -0,0 +1,85 @@
+{lib, ...}: {
+  perSystem = {pkgs, ...}: let
+    pname = "ocenaudio";
+    version = "3.17.3";
+  in {
+    packages.ocenaudio = pkgs.stdenv.mkDerivation {
+      inherit pname version;
+
+      src = pkgs.fetchurl {
+        name = "ocenaudio.deb";
+        url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian12.deb?version=v${version}";
+        hash = "sha256-NqQLYeX+QRXmZfFMmpuGc1EHm6IZMUJNY0/WiBnNdCw=";
+      };
+
+      nativeBuildInputs = [
+        pkgs.autoPatchelfHook
+        pkgs.qt6.wrapQtAppsHook
+        pkgs.dpkg
+        pkgs.patchelf
+      ];
+
+      buildInputs = [
+        pkgs.xz
+        pkgs.qt6.qtbase
+        pkgs.bzip2
+        pkgs.libjack2
+        pkgs.alsa-lib
+        pkgs.libpulseaudio
+      ];
+
+      dontBuild = true;
+      dontStrip = true;
+
+      unpackPhase = ''
+        runHook preUnpack
+        ${pkgs.dpkg}/bin/dpkg-deb -x $src .
+        runHook postUnpack
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        cp -r opt/ocenaudio $out
+        cp -r usr/share $out/share
+        substituteInPlace $out/share/applications/ocenaudio.desktop \
+          --replace-fail "/opt/ocenaudio/bin/ocenaudio" "ocenaudio"
+        mkdir -p $out/share/licenses/ocenaudio
+        mv $out/bin/ocenaudio_license.txt $out/share/licenses/ocenaudio/LICENSE
+        ln -s ${pkgs.bzip2.out}/lib/libbz2.so.1 $out/lib/libbz2.so.1.0
+
+        # Upstream currently ships a demucs plugin that can depend on older sonames
+        # than the bundled core libraries. Rewrite those NEEDED entries to whichever
+        # bundled libqtocen* versions are actually present before autoPatchelf runs.
+        demucs_lib=$(find $out/lib -maxdepth 1 -name 'libqtocendemucs.so*' | head -n1 || true)
+        if [ -n "$demucs_lib" ]; then
+          actual_qtocenai=$(find $out/lib -maxdepth 1 -name 'libqtocenai.so.*' | sort -V | tail -n1 || true)
+          actual_qtocencore=$(find $out/lib -maxdepth 1 -name 'libqtocencore.so.*' | sort -V | tail -n1 || true)
+
+          if [ -n "$actual_qtocenai" ]; then
+            ${pkgs.patchelf}/bin/patchelf \
+              --replace-needed libqtocenai.so.3.15 "$(basename "$actual_qtocenai")" \
+              "$demucs_lib" || true
+          fi
+
+          if [ -n "$actual_qtocencore" ]; then
+            ${pkgs.patchelf}/bin/patchelf \
+              --replace-needed libqtocencore.so.3.15 "$(basename "$actual_qtocencore")" \
+              "$demucs_lib" || true
+          fi
+        fi
+
+        runHook postInstall
+      '';
+
+      passthru.updateScript = ../../.gitea/scripts/update-ocenaudio-nix.sh;
+
+      meta = {
+        description = "Cross-platform, easy to use, fast and functional audio editor";
+        homepage = "https://www.ocenaudio.com";
+        sourceProvenance = with lib.sourceTypes; [binaryNativeCode];
+        platforms = ["x86_64-linux"];
+      };
+    };
+  };
+}