diff --git a/config/software/libarchive.rb b/config/software/libarchive.rb
index 4961172e0a2bf5b6c0690134ebca355372cf25ab_Y29uZmlnL3NvZnR3YXJlL2xpYmFyY2hpdmUucmI=..19e0c75336d394847c081e3b9a230de39ac2e505_Y29uZmlnL3NvZnR3YXJlL2xpYmFyY2hpdmUucmI= 100644
--- a/config/software/libarchive.rb
+++ b/config/software/libarchive.rb
@@ -15,7 +15,7 @@
 #
 
 name 'libarchive'
-default_version '3.6.2'
+default_version '3.7.4'
 
 license 'BSD-2-Clause'
 license_file 'COPYING'
@@ -23,7 +23,7 @@
 skip_transitive_dependency_licensing true
 
 source url: "https://www.libarchive.org/downloads/libarchive-#{version}.tar.gz",
-       sha256: 'ba6d02f15ba04aba9c23fd5f236bb234eab9d5209e95d1c4df85c44d5f19b9b3'
+       sha256: '7875d49596286055b52439ed42f044bd8ad426aa4cc5aabd96bfe7abb971d5e8'
 
 relative_path "libarchive-#{version}"
 
diff --git a/scripts/renovate/checksums/software/libarchive.sh b/scripts/renovate/checksums/software/libarchive.sh
new file mode 100755
index 0000000000000000000000000000000000000000..19e0c75336d394847c081e3b9a230de39ac2e505_c2NyaXB0cy9yZW5vdmF0ZS9jaGVja3N1bXMvc29mdHdhcmUvbGliYXJjaGl2ZS5zaA==
--- /dev/null
+++ b/scripts/renovate/checksums/software/libarchive.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+# Fetch and replace the libarchive checksum.
+# Dependencies: curl, sed, awk
+
+set -eo pipefail
+
+source "$(dirname "$0")/shared.sh"
+build_file="config/software/libarchive.rb"
+
+get_checksum() {
+  local version="$1"
+  local archive_name="*libarchive-${version}.tar.gz"
+
+  wget -q -O - "https://libarchive.org/downloads/sha256sums" | awk -v file="$archive_name" '{if($2==file){print $1}}'
+}
+
+version=$(get_default_version "$build_file")
+checksum=$(get_checksum "$version")
+replace_sha256_checksum "$checksum" "$build_file"
diff --git a/scripts/renovate/checksums/software/libxml2.sh b/scripts/renovate/checksums/software/libxml2.sh
index 4961172e0a2bf5b6c0690134ebca355372cf25ab_c2NyaXB0cy9yZW5vdmF0ZS9jaGVja3N1bXMvc29mdHdhcmUvbGlieG1sMi5zaA==..19e0c75336d394847c081e3b9a230de39ac2e505_c2NyaXB0cy9yZW5vdmF0ZS9jaGVja3N1bXMvc29mdHdhcmUvbGlieG1sMi5zaA== 100755
--- a/scripts/renovate/checksums/software/libxml2.sh
+++ b/scripts/renovate/checksums/software/libxml2.sh
@@ -5,11 +5,8 @@
 
 set -eo pipefail
 
-libxml2_build_file="config/software/libxml2.rb"
-
-get_target_version() {
-  sed -nr "s|default_version '(.*)'|\1|p" "$libxml2_build_file"
-}
+source "$(dirname "$0")/shared.sh"
+build_file="config/software/libxml2.rb"
 
 get_checksum() {
   local version="$1"
@@ -21,12 +18,5 @@
   wget -q -O - "$checksum_file_url" | awk -v file="$archive_name" '{if($2==file){print $1}}'
 }
 
-replace_checksum() {
-  local new_checksum="$1"
-  local libxml2_build_file="config/software/libxml2.rb"
-
-  sed -i "s|sha256: '\w*'|sha256: '${new_checksum}'|" "$libxml2_build_file"
-}
-
-version=$(get_target_version)
+version=$(get_default_version "$build_file")
 checksum=$(get_checksum "$version")
@@ -32,2 +22,2 @@
 checksum=$(get_checksum "$version")
-replace_checksum "$checksum"
+replace_sha256_checksum "$checksum" "$build_file"
diff --git a/scripts/renovate/checksums/software/shared.sh b/scripts/renovate/checksums/software/shared.sh
new file mode 100755
index 0000000000000000000000000000000000000000..19e0c75336d394847c081e3b9a230de39ac2e505_c2NyaXB0cy9yZW5vdmF0ZS9jaGVja3N1bXMvc29mdHdhcmUvc2hhcmVkLnNo
--- /dev/null
+++ b/scripts/renovate/checksums/software/shared.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+get_default_version() {
+  sed -nr "s|default_version '(.*)'|\1|p" "${1}"
+}
+
+replace_sha256_checksum() {
+  local new_checksum="${1}"
+  local build_file="${2}"
+
+  sed -i "s|sha256: '\w*'|sha256: '${new_checksum}'|" "$build_file"
+}