diff --git a/home/.chezmoiscripts/run_after_30-install-homebrew-packages.sh.tmpl b/home/.chezmoiscripts/run_after_30-install-homebrew-packages.sh.tmpl
index 1c0dfef..960b805 100644
--- a/home/.chezmoiscripts/run_after_30-install-homebrew-packages.sh.tmpl
+++ b/home/.chezmoiscripts/run_after_30-install-homebrew-packages.sh.tmpl
@@ -47,6 +47,7 @@ if ! brew --version &>/dev/null; then
 fi
 
 readonly unwanted_packages=(
+  chezmoi
   jq
   volta
   deno
diff --git a/home/dot_local/bin/executable_full-upgrade.tmpl b/home/dot_local/bin/executable_full-upgrade.tmpl
index 8a0b91e..1e54dca 100644
--- a/home/dot_local/bin/executable_full-upgrade.tmpl
+++ b/home/dot_local/bin/executable_full-upgrade.tmpl
@@ -12,21 +12,24 @@ true || source ../../.chezmoitemplates/volta-library
 ensure_path_entry "${HOME}/.local/bin"
 
 if [[ "${CONTINUE_FROM_DOTFILES:-false}" == false ]]; then
-  if brew --version &>/dev/null; then
-    (
-      export HOMEBREW_NO_AUTO_UPDATE=1
-      export HOMEBREW_NO_UPDATE_REPORT_NEW=1
-      export HOMEBREW_NO_ENV_HINTS=1
-
-      log_task "Updating brew"
-      c brew update
-
-      log_task "Updating brew packages"
-      c brew upgrade
-    )
-  fi
-
   if chezmoi --version &>/dev/null; then
+    log_task "Updating chezmoi"
+
+    current_version=$(chezmoi execute-template '{{ .chezmoi.version.version }}')
+    latest_version=$(curl -fsSL -o /dev/null -w "%{url_effective}" https://github.com/twpayne/chezmoi/releases/latest)
+    # remove everything after last slash
+    latest_version="${latest_version##*/}"
+    # remove leading v
+    latest_version="${latest_version#v}"
+    if [[ "${current_version}" == "${latest_version}" ]]; then
+      log_info "chezmoi is already up to date"
+    else
+      c curl -fsSL -o "${HOME}/.local/bin/chezmoi" \
+        "https://github.com/twpayne/chezmoi/releases/download/v${latest_version}/chezmoi-linux-amd64"
+      c chmod +x "${HOME}/.local/bin/chezmoi"
+    fi
+    unset current_version latest_version
+
     log_task "Updating dotfiles"
 
     if chezmoi git -- status --porcelain | grep -q .; then
@@ -112,6 +115,20 @@ if pkgx --version &>/dev/null; then
   unset pkgx_packages
 fi
 
+if brew --version &>/dev/null; then
+  (
+    export HOMEBREW_NO_AUTO_UPDATE=1
+    export HOMEBREW_NO_UPDATE_REPORT_NEW=1
+    export HOMEBREW_NO_ENV_HINTS=1
+
+    log_task "Updating brew"
+    c brew update
+
+    log_task "Updating brew packages"
+    c brew upgrade
+  )
+fi
+
 if apt --version &>/dev/null; then
   log_task "Updating apt packages"
   c sudo DEBIAN_FRONTEND=noninteractive apt update --yes