diff --git a/.github/workflows/cron.yml b/.github/workflows/cron.yml
index adad95f..1a6ea75 100644
--- a/.github/workflows/cron.yml
+++ b/.github/workflows/cron.yml
@@ -13,16 +13,16 @@ jobs:
       - uses: actions/checkout@v2
 
       - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
-          go-version: 1.18
+          go-version: 'stable'
 
       - name: Check latest kernel version from https://archive.raspberrypi.org/debian/
         id: check
         run: |
           # split lines to fail on exit != 0
           sha="$(go run ./cmd/check-update/main.go)"
-          echo "::set-output name=sha::$sha"
+          echo "sha=$sha" >> $GITHUB_OUTPUT
 
       - name: Fetch latest kernel
         if: steps.check.outputs.sha != ''
@@ -35,7 +35,7 @@ jobs:
 
           # split lines to fail on exit != 0
           version="$(make kernelversion)"
-          echo "::set-output name=version::$version"
+          echo "version=$version" >> $GITHUB_OUTPUT
           cd ..
           git diff --no-ext-diff
 
diff --git a/cmd/check-update/main.go b/cmd/check-update/main.go
index 3e8f6f7..a87e3e4 100644
--- a/cmd/check-update/main.go
+++ b/cmd/check-update/main.go
@@ -1,16 +1,20 @@
 package main
 
 import (
+	"archive/tar"
 	"bufio"
 	"compress/gzip"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"log"
 	"net/http"
 	"os"
 	"os/exec"
 	"strings"
+
+	"github.com/ulikunitz/xz"
 )
 
 func main() {
@@ -56,7 +60,7 @@ func run() error {
 
 	log.Println("latest version:", tagName)
 
-	latestSha, err := githubCommitSha(tagName)
+	latestSha, err := commitFromTag(tagName)
 	if err != nil {
 		return err
 	}
@@ -77,6 +81,20 @@ func run() error {
 	return nil
 }
 
+func commitFromTag(tagName string) (string, error) {
+	latestSha, err := githubCommitSha(tagName)
+	log.Println("checking https://github.com/raspberrypi/linux tags")
+	if err == nil {
+		return latestSha, nil
+	}
+	log.Println(err)
+
+	xzURL := "https://archive.raspberrypi.org/debian/pool/main/r/raspberrypi-firmware/raspberrypi-firmware_" + tagName + ".orig.tar.xz"
+
+	log.Println("checking", xzURL)
+	return debianSourceCommitSha(xzURL)
+}
+
 func githubCommitSha(tagName string) (string, error) {
 	req, err := http.NewRequest("GET", "https://api.github.com/repos/raspberrypi/linux/git/ref/tags/"+tagName, nil)
 	if err != nil {
@@ -101,11 +119,48 @@ func githubCommitSha(tagName string) (string, error) {
 		return "", err
 	}
 	if gr.Object.Sha == "" {
-		return "", errors.New("could not get sha: " + gr.Message)
+		return "", fmt.Errorf("could not get sha for tag %q: %s", tagName, gr.Message)
 	}
 	return gr.Object.Sha, nil
 }
 
+func debianSourceCommitSha(xzURL string) (string, error) {
+	resp, err := http.Get(xzURL)
+	if err != nil {
+		return "", err
+	}
+	xzFile := resp.Body
+
+	//  for local testing
+	// xzFile, err := os.Open("raspberrypi-firmware_1.20230317.orig.tar.xz")
+	// if err != nil {
+	// 	return "", err
+	// }
+	defer xzFile.Close()
+
+	tarFile, err := xz.NewReader(xzFile)
+	if err != nil {
+		return "", err
+	}
+
+	tr := tar.NewReader(tarFile)
+	for {
+		hdr, err := tr.Next()
+		if err != nil {
+			return "", fmt.Errorf("extra/git_hash not found: %w", err)
+		}
+		if !strings.HasSuffix(hdr.Name, "/extra/git_hash") {
+			continue
+		}
+
+		buf, err := io.ReadAll(tr)
+		if err != nil {
+			return "", err
+		}
+		return strings.TrimSpace(string(buf)), nil
+	}
+}
+
 func submoduleSha(submodule string) (string, error) {
 	cmd := exec.Command("git", "rev-parse", "HEAD:"+submodule)
 	cmd.Stderr = os.Stderr
diff --git a/go.mod b/go.mod
index 7acc730..71f924b 100644
--- a/go.mod
+++ b/go.mod
@@ -3,3 +3,5 @@ module github.com/gokrazy-community/kernel-rpi-os-32
 go 1.18
 
 require github.com/magefile/mage v1.13.0
+
+require github.com/ulikunitz/xz v0.5.11 // indirect
diff --git a/go.sum b/go.sum
index 9739604..e8d8a8d 100644
--- a/go.sum
+++ b/go.sum
@@ -1,2 +1,4 @@
 github.com/magefile/mage v1.13.0 h1:XtLJl8bcCM7EFoO8FyH8XK3t7G5hQAeK+i4tq+veT9M=
 github.com/magefile/mage v1.13.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
+github.com/ulikunitz/xz v0.5.11 h1:kpFauv27b6ynzBNT/Xy+1k+fK4WswhN/6PN5WhFAGw8=
+github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=