---
title: "Update integrity · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/update-integrity
parts: 4
tokens_total: 3201
updated: 2026-10-22
tokens: 723
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Update integrity

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Desktop apps, extensions and CLIs](https://agentwranglers.se/playbook/desktop-apps.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

> Install only updates signed by your own key and never an older version. Roll each update out in stages, with a switch that stops it.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/update-integrity">Agent Wranglers desktop apps, extensions and CLIs playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- DSK-6 [Verify every update's signature before installing it](https://agentwranglers.se/playbook/desktop-apps/update-integrity/signed-updates.md) · 953 tokens · updated 2026-10-22
  Sign every update file with a key held apart from your update server, and ship the public key inside the app. The app installs an update only after its signature checks out, and fetches it over HTTPS.

## Recommended

- DSK-7 [Refuse updates older than the installed version](https://agentwranglers.se/playbook/desktop-apps/update-integrity/no-downgrades.md) · 788 tokens · updated 2026-10-22
  The app installs only a version higher than the one it runs, and it reads that version from the signed update data. A downgrade happens only when a person chooses it.
- DSK-8 [Roll out each update in stages with a stop switch](https://agentwranglers.se/playbook/desktop-apps/update-integrity/staged-desktop-updates.md) · 887 tokens · updated 2026-10-22
  Offer each update to at most 10% of installs first, and widen it only while the crash rate stays at the last version's level. Keep a switch on the update server that stops the rollout within 5 minutes.
- DSK-9 [Keep the bundled browser engine current](https://agentwranglers.se/playbook/desktop-apps/update-integrity/current-app-runtime.md) · 573 tokens · updated 2026-10-22
  When the app ships its own browser engine, as Electron does, move to each new major version within 8 weeks of its release. Never ship on a version its makers no longer patch.

## Read this with

- [Connected devices playbook](https://agentwranglers.se/playbook/connected-devices.md). Desktop updates face the same attacks as firmware. Signatures, refusing old versions and staged rollouts work the same way.

- Previous: [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md)
- Next: [Web code inside desktop apps](https://agentwranglers.se/playbook/desktop-apps/web-code-inside-desktop-apps.md)
- [All chapters](https://agentwranglers.se/playbook/desktop-apps.md)