diff --git a/mkosi.images/system/mkosi.clean b/mkosi.images/system/mkosi.clean
index cb716c41f7..64810b7957 100755
--- a/mkosi.images/system/mkosi.clean
+++ b/mkosi.images/system/mkosi.clean
@@ -1,4 +1,5 @@
 #!/bin/bash
 set -e
+set -o nounset
 
 rm -f "$OUTPUTDIR"/*.{rpm,deb,pkg.tar}
diff --git a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
index 386c1923a5..abb55884ee 100644
--- a/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf.d/10-debian-ubuntu/mkosi.conf
@@ -8,7 +8,7 @@ Distribution=|ubuntu
 Environment=
         GIT_URL=https://salsa.debian.org/systemd-team/systemd.git
         GIT_BRANCH=debian/master
-        GIT_COMMIT=1ac6c92c9633fe6fd47f34119c04cae36da14d6a
+        GIT_COMMIT=5b9607385d49c09440e6e3b35c03ceec73162aec
 
 VolatilePackages=
         libnss-myhostname
diff --git a/mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf b/mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf
index 7b122e3c69..689fe7d5c7 100644
--- a/mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf
+++ b/mkosi.images/system/mkosi.conf.d/10-fedora/mkosi.conf
@@ -7,7 +7,7 @@ Distribution=fedora
 Environment=
         GIT_URL=https://src.fedoraproject.org/rpms/systemd.git
         GIT_BRANCH=rawhide
-        GIT_COMMIT=74810c5bc4fe7d872e54c253447ffd61bbc8839f
+        GIT_COMMIT=1f94b56cee818068f57debfd78f035edd29f0e61
 
 Packages=
         btrfs-progs
diff --git a/mkosi.images/system/mkosi.postinst.chroot b/mkosi.images/system/mkosi.postinst.chroot
index 397884b720..acb4e631e9 100755
--- a/mkosi.images/system/mkosi.postinst.chroot
+++ b/mkosi.images/system/mkosi.postinst.chroot
@@ -1,6 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
+set -o nounset
 
 if command -v authselect >/dev/null; then
     # authselect 1.5.0 renamed the minimal profile to the local profile without keeping backwards compat so
diff --git a/mkosi.images/system/mkosi.sanitizers.chroot b/mkosi.images/system/mkosi.sanitizers.chroot
index 854a419933..524e3dadb1 100755
--- a/mkosi.images/system/mkosi.sanitizers.chroot
+++ b/mkosi.images/system/mkosi.sanitizers.chroot
@@ -1,8 +1,9 @@
 #!/bin/bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
+set -o nounset
 
-if [[ -z "$SANITIZERS" ]]; then
+if [[ -z "${SANITIZERS:-}" ]]; then
     exit 0
 fi
 
@@ -18,7 +19,7 @@ EOF
 # ASAN and syscall filters aren't compatible with each other.
 find /usr /etc -name '*.service' -type f -exec sed -i 's/^\(MemoryDeny\|SystemCall\)/# \1/' {} +
 
-# `systemd-hwdb update` takes > 50s when built with sanitizers so let's not run it by default.
+# 'systemd-hwdb update' takes > 50s when built with sanitizers so let's not run it by default.
 systemctl mask systemd-hwdb-update.service
 
 ASAN_RT_PATH="$(grep libasan.so < <(ldd /usr/lib/systemd/systemd) | cut -d ' ' -f 3)"
diff --git a/mkosi.images/system/mkosi.sync b/mkosi.images/system/mkosi.sync
index a4f0ab94ec..6856af7c6b 100755
--- a/mkosi.images/system/mkosi.sync
+++ b/mkosi.images/system/mkosi.sync
@@ -1,8 +1,9 @@
 #!/bin/bash
 # SPDX-License-Identifier: LGPL-2.1-or-later
 set -e
+set -o nounset
 
-if ((NO_SYNC)); then
+if ((${NO_SYNC:-0})); then
     exit 0
 fi
 
diff --git a/tools/update-distro-hash.py b/tools/update-distro-hash.py
new file mode 100755
index 0000000000..16ed2e707a
--- /dev/null
+++ b/tools/update-distro-hash.py
@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+"""
+Fetch commits for pkg/{distribution} and, if changed, commit the latest hash.
+"""
+
+import argparse
+import json
+import shlex
+import subprocess
+from pathlib import Path
+
+def parse_args():
+    p = argparse.ArgumentParser(
+        description=__doc__,
+    )
+    p.add_argument(
+        'distribution',
+        nargs='+',
+    )
+    p.add_argument(
+        '--no-fetch',
+        dest='fetch',
+        action='store_false',
+        default=True,
+    )
+    return p.parse_args()
+
+def read_config(distro: str):
+    cmd = ['mkosi', '--json', '-d', distro, 'summary']
+    print(f"+ {shlex.join(cmd)}")
+    text = subprocess.check_output(cmd, text=True)
+
+    data = json.loads(text)
+    return data['Images'][-1]
+
+def commit_file(distro: str, file: Path, commit: str, changes: str):
+    message = '\n'.join((
+        f'mkosi: update {distro} commit reference',
+        '',
+        changes))
+
+    cmd = ['git', 'commit', '-m', message, str(file)]
+    print(f"+ {shlex.join(cmd)}")
+    subprocess.check_call(cmd)
+
+def update_distro(args, distro: str):
+    cmd = ['git', '-C', f'pkg/{distro}', 'fetch']
+    print(f"+ {shlex.join(cmd)}")
+    subprocess.check_call(cmd)
+
+    config = read_config(distro)
+
+    branch = config['Environment']['GIT_BRANCH']
+    old_commit = config['Environment']['GIT_COMMIT']
+
+    cmd = ['git', '-C', f'pkg/{distro}', 'rev-parse', f'refs/remotes/origin/{branch}']
+    print(f"+ {shlex.join(cmd)}")
+    new_commit = subprocess.check_output(cmd, text=True).strip()
+
+    if old_commit == new_commit:
+        print(f'{distro}: commit {new_commit!s} is still fresh')
+        return
+
+    cmd = ['git', '-C', f'pkg/{distro}', 'log', '--graph',
+           '--pretty=oneline', '--no-decorate', '--abbrev-commit', '--abbrev=10',
+           f'{old_commit}..{new_commit}']
+    print(f"+ {shlex.join(cmd)}")
+    changes = subprocess.check_output(cmd, text=True).strip()
+
+    conf_dir = Path('mkosi.images/system/mkosi.conf.d')
+    files = conf_dir.glob('*/*.conf')
+    for file in files:
+        s = file.read_text()
+        if old_commit in s:
+            print(f'{distro}: {file}: found old hash, updating…')
+            new = s.replace(old_commit, new_commit)
+            assert new != s
+            file.write_text(new)
+            commit_file(distro, file, new_commit, changes)
+            break
+    else:
+        raise ValueError(f'{distro}: hash {new_commit} not found under {conf_dir}')
+
+if __name__ == '__main__':
+    args = parse_args()
+    for distro in args.distribution:
+        update_distro(args, distro)