diff --git a/pkgs/servers/monitoring/grafana/default.nix b/pkgs/servers/monitoring/grafana/default.nix
index 9dc861c75866..3b4d930d4537 100644
--- a/pkgs/servers/monitoring/grafana/default.nix
+++ b/pkgs/servers/monitoring/grafana/default.nix
@@ -1,8 +1,38 @@
-{ lib, buildGoModule, fetchurl, fetchFromGitHub, nixosTests, tzdata, wire }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub, removeReferencesTo
+, tzdata, wire
+, yarn, nodejs, cacert
+, jq, moreutils
+, nix-update-script, nixosTests
+}:
 
+let
+  # We need dev dependencies to run webpack, but patch away
+  # `cypress` (and @grafana/e2e which has a direct dependency on cypress).
+  # This attempts to download random blobs from the Internet in
+  # postInstall. Also, it's just a testing framework, so not worth the hassle.
+  patchAwayGrafanaE2E = ''
+    find . -name package.json | while IFS=$'\n' read -r pkg_json; do
+      <"$pkg_json" jq '. + {
+        "devDependencies": .devDependencies | del(."@grafana/e2e") | del(.cypress)
+      }' | sponge "$pkg_json"
+    done
+    rm -r packages/grafana-e2e
+  '';
+
+  # Injects a `t.Skip()` into a given test since
+  # there's apparently no other way to skip tests here.
+  skipTest = lineOffset: testCase: file:
+    let
+      jumpAndAppend = lib.concatStringsSep ";" (lib.replicate (lineOffset - 1) "n" ++ [ "a" ]);
+    in ''
+      sed -i -e '/${testCase}/{
+      ${jumpAndAppend} t.Skip();
+      }' ${file}
+    '';
+in
 buildGoModule rec {
   pname = "grafana";
-  version = "10.2.3";
+  version = "10.3.1";
 
   excludedPackages = [ "alert_webhook_listener" "clean-swagger" "release_publisher" "slow_proxy" "slow_proxy_mac" "macaron" "devenv" "modowners" ];
 
@@ -10,28 +40,47 @@ buildGoModule rec {
     owner = "grafana";
     repo = "grafana";
     rev = "v${version}";
-    hash = "sha256-F61RtPEjQ4uFVcJLG04CD4//w8X7uJinxzYyoW/MosA=";
+    hash = "sha256-UPIq7BWTlT0omt/SM5+vkfOHvsdcx/ikkjcW9X8pcw0=";
   };
 
-  srcStatic = fetchurl {
-    url = "https://dl.grafana.com/oss/release/grafana-${version}.linux-amd64.tar.gz";
-    hash = "sha256-xoZgaml1SB9PEI3kTE3zRlJR5O4tog58bua2blvc8to=";
+  offlineCache = stdenv.mkDerivation {
+    name = "${pname}-${version}-yarn-offline-cache";
+    inherit src;
+    nativeBuildInputs = [
+      yarn nodejs cacert
+      jq moreutils
+    ];
+    postPatch = ''
+      ${patchAwayGrafanaE2E}
+    '';
+    buildPhase = ''
+      runHook preBuild
+      export HOME="$(mktemp -d)"
+      yarn config set enableTelemetry 0
+      yarn config set cacheFolder $out
+      yarn config set --json supportedArchitectures.os '[ "linux" ]'
+      yarn config set --json supportedArchitectures.cpu '["arm", "arm64", "ia32", "x64"]'
+      yarn
+      runHook postBuild
+    '';
+    dontConfigure = true;
+    dontInstall = true;
+    dontFixup = true;
+    outputHashMode = "recursive";
+    outputHash = "sha256-70eMa8E483f/Bz7iy+4Seap1EfIdjD5krnt6W9CUows=";
   };
 
-  vendorHash = "sha256-rQOnuh6t+cUqyAAnUhGgxMaW88pawnauAGQd6w0T57Q=";
+  disallowedRequisites = [ offlineCache ];
 
-  nativeBuildInputs = [ wire ];
+  vendorHash = "sha256-Gf2A22d7/8xU/ld7kveqGonVKGFCArGNansPRGhfyXM=";
 
-  postConfigure = let
-    skipTest = lineOffset: testCase: file:
-      let
-        jumpAndAppend = lib.concatStringsSep ";" (lib.replicate (lineOffset - 1) "n" ++ [ "a" ]);
-      in ''
-        sed -i -e '/${testCase}/{
-        ${jumpAndAppend} t.Skip();
-        }' ${file}
-      '';
-  in ''
+  nativeBuildInputs = [ wire yarn jq moreutils removeReferencesTo ];
+
+  postPatch = ''
+    ${patchAwayGrafanaE2E}
+  '';
+
+  postConfigure = ''
     # Generate DI code that's required to compile the package.
     # From https://github.com/grafana/grafana/blob/v8.2.3/Makefile#L33-L35
     wire gen -tags oss ./pkg/server
@@ -69,6 +118,18 @@ buildGoModule rec {
     # grafana> 2023/08/24 08:30:23 failed to copy objects, err: Post "https://storage.googleapis.com/upload/storage/v1/b/grafana-testing-repo/o?alt=json&name=test-path%2Fbuild%2FTestCopyLocalDir2194093976%2F001%2Ffile2.txt&prettyPrint=false&projection=full&uploadType=multipart": dial tcp: lookup storage.googleapis.com on [::1]:53: read udp [::1]:36436->[::1]:53: read: connection refused
     # grafana> panic: test timed out after 10m0s
     rm pkg/build/gcloud/storage/gsutil_test.go
+
+    # Setup node_modules
+    export HOME="$(mktemp -d)"
+    yarn config set enableTelemetry 0
+    yarn config set cacheFolder $offlineCache
+    yarn --immutable-cache
+  '';
+
+  postBuild = ''
+    # After having built all the Go code, run the JS builders now.
+    yarn run build
+    yarn run plugins:build-bundled
   '';
 
   ldflags = [
@@ -86,16 +147,19 @@ buildGoModule rec {
   '';
 
   postInstall = ''
-    tar -xvf $srcStatic
     mkdir -p $out/share/grafana
-    mv grafana-*/{public,conf,tools} $out/share/grafana/
+    cp -r public conf $out/share/grafana/
+  '';
 
-    cp ./conf/defaults.ini $out/share/grafana/conf/
+  postFixup = ''
+    while read line; do
+      remove-references-to -t $offlineCache "$line"
+    done < <(find $out -type f -name '*.js.map' -or -name '*.js')
   '';
 
   passthru = {
     tests = { inherit (nixosTests) grafana; };
-    updateScript = ./update.sh;
+    updateScript = nix-update-script { };
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/monitoring/grafana/update.sh b/pkgs/servers/monitoring/grafana/update.sh
deleted file mode 100755
index 3fd4fd56be7c..000000000000
--- a/pkgs/servers/monitoring/grafana/update.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl common-updater-scripts jq nix nix-prefetch-scripts moreutils
-
-set -euxo pipefail
-
-FILE="$(nix-instantiate --eval -E 'with import ./. {}; (builtins.unsafeGetAttrPos "version" grafana).file' | tr -d '"')"
-replaceHash() {
-  old="${1?old hash missing}"
-  new="${2?new hash missing}"
-  awk -v OLD="$old" -v NEW="$new" '{
-    if (i=index($0, OLD)) {
-      $0 = substr($0, 1, i-1) NEW substr($0, i+length(OLD));
-    }
-    print $0;
-  }' "$FILE" | sponge "$FILE"
-}
-extractVendorHash() {
-  original="${1?original hash missing}"
-  result="$(nix-build -A grafana.goModules 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
-  [ -z "$result" ] && { echo "$original"; } || { echo "$result"; }
-}
-
-oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion grafana" | tr -d '"')"
-latest="$(curl https://api.github.com/repos/grafana/grafana/releases/latest | jq '.tag_name' -r | tr -d 'v')"
-
-targetVersion="${1:-$latest}"
-if [ ! "${oldVersion}" = "${targetVersion}" ]; then
-  update-source-version grafana "${targetVersion#v}"
-  oldStaticHash="$(nix-instantiate --eval -A grafana.srcStatic.outputHash | tr -d '"')"
-  newStaticHash="$(nix-prefetch-url "https://dl.grafana.com/oss/release/grafana-${targetVersion#v}.linux-amd64.tar.gz")"
-  newStaticHash="$(nix hash to-sri --type sha256 $newStaticHash)"
-  replaceHash "$oldStaticHash" "$newStaticHash"
-  goHash="$(nix-instantiate --eval -A grafana.vendorHash | tr -d '"')"
-  emptyHash="$(nix-instantiate --eval -A lib.fakeHash | tr -d '"')"
-  replaceHash "$goHash" "$emptyHash"
-  replaceHash "$emptyHash" "$(extractVendorHash "$goHash")"
-  nix-build -A grafana
-else
-  echo "grafana is already up-to-date"
-fi