diff --git a/pkgs/by-name/mu/mullvad-browser/package.nix b/pkgs/by-name/mu/mullvad-browser/package.nix
index b4662af7b598..8c847f3c365b 100644
--- a/pkgs/by-name/mu/mullvad-browser/package.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -90,7 +90,7 @@ let
       ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "13.5.3";
+  version = "13.5.6";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -102,7 +102,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-rJKOkVfWs5q3eF+ffeBLIQaAMtoR7KzoNQlv64iNWJ8=";
+      hash = "sha256-AayGWFfsdAK9Ku4J4nDolJxnQn0HhGeZeEf//9OspWA=";
     };
   };
 
diff --git a/pkgs/by-name/mu/mullvad-browser/update.nix b/pkgs/by-name/mu/mullvad-browser/update.nix
index 04b69d8ce208..7faf4c31efbf 100644
--- a/pkgs/by-name/mu/mullvad-browser/update.nix
+++ b/pkgs/by-name/mu/mullvad-browser/update.nix
@@ -56,7 +56,7 @@ in writeShellScript "update-${pname}" ''
 
   for platform in ${lib.escapeShellArgs meta.platforms}; do
     arch="''${platforms[$platform]}"
-    sha256=$(grep "${name}-$arch-$version.tar.xz" "$HOME/shasums" | cut -d" " -f1)
+    sha256=$(grep "${name}-$arch-$version.tar.xz" "$HOME/shasums" | head -1 | cut -d" " -f1)
     hash=$(nix hash to-sri --type sha256 "$sha256")
 
     update-source-version "${pname}" "$version" "$hash" --ignore-same-version --source-key="sources.$platform"
diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix
index 48d2070a0fbd..43293874ddf6 100644
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -101,7 +101,7 @@ lib.warnIf (useHardenedMalloc != null)
       ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "13.5.5";
+  version = "13.5.6";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -111,7 +111,7 @@ lib.warnIf (useHardenedMalloc != null)
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-5Gwr7gKI5HVyAymi04BjiKTAIrYSSLVmIBu882XZ7gw=";
+      hash = "sha256-dEairGoBMsXF4gtnnqa2KsA8PpW9VwF8woUrInVWuKM=";
     };
 
     i686-linux = fetchurl {
@@ -121,7 +121,7 @@ lib.warnIf (useHardenedMalloc != null)
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-kpRtPM7jTYm6wmYiFT89B4Ue7kbsWweUxqXzeNtLCdo=";
+      hash = "sha256-9WRN+iU7vvt9KvVudsS7qe0hoJwDP/J+yOTHW7nmrxs=";
     };
   };
 
diff --git a/pkgs/by-name/to/tor-browser/update.nix b/pkgs/by-name/to/tor-browser/update.nix
index 04b69d8ce208..7faf4c31efbf 100644
--- a/pkgs/by-name/to/tor-browser/update.nix
+++ b/pkgs/by-name/to/tor-browser/update.nix
@@ -56,7 +56,7 @@ in writeShellScript "update-${pname}" ''
 
   for platform in ${lib.escapeShellArgs meta.platforms}; do
     arch="''${platforms[$platform]}"
-    sha256=$(grep "${name}-$arch-$version.tar.xz" "$HOME/shasums" | cut -d" " -f1)
+    sha256=$(grep "${name}-$arch-$version.tar.xz" "$HOME/shasums" | head -1 | cut -d" " -f1)
     hash=$(nix hash to-sri --type sha256 "$sha256")
 
     update-source-version "${pname}" "$version" "$hash" --ignore-same-version --source-key="sources.$platform"