diff --git a/pkgs/by-name/dp/dput-ng/package.nix b/pkgs/by-name/dp/dput-ng/package.nix
index ec8978f63f7d..c73978a3f496 100644
--- a/pkgs/by-name/dp/dput-ng/package.nix
+++ b/pkgs/by-name/dp/dput-ng/package.nix
@@ -5,7 +5,7 @@
   nix-update-script,
 }:
 let
-  version = "1.42";
+  version = "1.43";
 in
 python3.pkgs.buildPythonApplication {
   pname = "dput-ng";
@@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication {
     owner = "debian";
     repo = "dput-ng";
     tag = "debian/${version}";
-    hash = "sha256-v1Q2vPQcghHZXSxnbjZ/0wFVNj1ApKFduUkEhBea1hI=";
+    hash = "sha256-zrH4h4C4y3oTiOXsidFv/rIJNzCdV2lqzNEg0SOkX4w=";
   };
 
   build-system = with python3.pkgs; [
@@ -46,7 +46,13 @@ python3.pkgs.buildPythonApplication {
   # Requires running dpkg
   disabledTestPaths = [ "tests/test_upload.py" ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    # Debian's tagging scheme is the bane of my existence.
+    # Essentially: all tags from 1.40 onwards start with `debian/`,
+    # then the version, and then an optional suffix (usually reserved for backports).
+    # We want to ignore the backport versions, and strip the `debian/` prefix.
+    extraArgs = [ "--version-regex=(?:debian\/)?(\d+(?:\.\d+)*)(?:[_\+].*)?" ];
+  };
 
   meta = {
     description = "Next-generation Debian package upload tool";