@@ -96,7 +96,7 @@ function domainAnswer(code: string) {
   };
 }
 
-async function setup(page: Page, cfg: RuntimeConfig | null, opts: { native?: unknown; signedIn?: boolean; provider?: "anthropic" | "bedrock"; blocked?: boolean; domain?: string; history?: unknown[]; version?: Record<string, unknown>; blockers?: unknown[]; onlyBlockers?: unknown[] } = {}) {
+async function setup(page: Page, cfg: RuntimeConfig | null, opts: { native?: unknown; signedIn?: boolean; provider?: "anthropic" | "bedrock"; blocked?: boolean; domain?: string; history?: unknown[]; version?: Record<string, unknown>; checked?: Record<string, unknown>; blockers?: unknown[]; onlyBlockers?: unknown[] } = {}) {
   const calls: string[] = [];
   const domainState = { code: opts.domain ?? "none" };
   const checksState = { fixed: false, runs: 0 };
@@ -128,7 +128,8 @@ async function setup(page: Page, cfg: RuntimeConfig | null, opts: { native?: unk
         deployment_provider: opts.provider ?? "anthropic",
       });
     }
-    if (p === "/api/system/version") {
+    if (p === "/api/system/version" || p === "/api/system/releases/check") {
+      if (p !== "/api/system/version") systemCalls.push({ path: p, body: JSON.parse(req.postData() || "{}") });
       return json(route, {
         self_hosted: true,
         current: { version: "v1.2.0", commit: "abc1234def", released_at: "2026-10-01T00:00:00Z", config_fingerprint: "0123456789ab" },
@@ -142,6 +143,7 @@ async function setup(page: Page, cfg: RuntimeConfig | null, opts: { native?: unk
           { id: "UPDATE#0", version: "v1.1.5", from_version: "v1.1.0", actor: "owner@example.org", mode: "update", status: "rolled_back", started_at: "2026-10-02T03:00:00Z", reason: "health check failed after deploying v1.1.5; back on v1.1.0" },
         ],
         ...(opts.version ?? {}),
+        ...(p === "/api/system/version" ? {} : (opts.checked ?? {})),
       });
     }
     if (p === "/api/system/auto-update") {
@@ -297,7 +299,8 @@ for (const [name, viewport] of [["desktop", { width: 1280, height: 800 }], ["pho
 
       await page.getByRole("button", { name: "Update now to v2.0.0" }).click();
       await expect.poll(() => systemCalls.map((c) => c.path)).toContain("/api/system/update");
-      expect(systemCalls.find((c) => c.path === "/api/system/update")!.body).toEqual({ version: "v2.0.0" });
+      // No version: the updater reads GitHub first and installs the newest release at that moment.
+      expect(systemCalls.find((c) => c.path === "/api/system/update")!.body).toEqual({});
 
       await page.getByRole("switch", { name: "Install updates automatically" }).click();
       await pickOption(page.getByRole("combobox", { name: "Day" }), "sat");
@@ -551,7 +554,7 @@ test("System: a one-stack install's Update applies it, and shows it running", as
   await expect(page.getByRole("button", { name: "Prepare the update to v2.0.0" })).toHaveCount(0);
   await page.getByRole("button", { name: "Update to v2.0.0" }).click();
   await expect.poll(() => systemCalls.map((c) => c.path)).toContain("/api/system/update");
-  expect(systemCalls.find((c) => c.path === "/api/system/update")!.body).toEqual({ version: "v2.0.0" });
+  expect(systemCalls.find((c) => c.path === "/api/system/update")!.body).toEqual({});
 });
 
 test("System: a running one-stack update says so, with nothing to do and no console step", async ({ page }) => {
@@ -756,6 +759,55 @@ for (const [name, viewport] of [["desktop", { width: 1280, height: 800 }], ["pho
       await page.screenshot({ path: `${SHOTS}/system-version-updating-${name}.png`, fullPage: true });
     });
 
+    test("Check for updates reads GitHub now and shows the newer release, Checked just now", async ({ page }) => {
+      const hourAgo = Math.floor(Date.now() / 1000) - 31 * 60;
+      const { systemCalls } = await setup(page, SELF, {
+        signedIn: true,
+        onlyBlockers: [],
+        version: { latest: null, update_available: false, releases: { fetched_at: hourAgo, stale: false, reason: null, error: null, behind: null } },
+        checked: {
+          latest: { version: "v1.3.0", notes: "## Changes\n\n- Fixes.", published_at: "2026-11-04T17:22:00Z", url: "https://example.org/r", breaking: false },
+          update_available: true,
+          releases: { fetched_at: Math.floor(Date.now() / 1000), stale: false, reason: null, error: null, behind: null },
+        },
+      });
+      await page.goto("/settings/system/");
+      const status = page.getByTestId("update-status");
+      await expect(status).toHaveAttribute("data-state", "current");
+      const check = page.getByTestId("release-check");
+      await expect(check).toContainText("Checked 31 min ago");
+      await check.getByRole("button", { name: "Check for updates" }).click();
+      await expect(check).toContainText("Checked just now");
+      expect(systemCalls.filter((c) => c.path === "/api/system/releases/check")).toHaveLength(1);
+      await expect(status).toHaveAttribute("data-state", "available");
+      await expect(status.getByRole("button", { name: "Update now to v1.3.0" })).toBeEnabled();
+      const width = await page.evaluate(() => document.documentElement.scrollWidth);
+      expect(width).toBeLessThanOrEqual(viewport.width);
+      await page.screenshot({ path: `${SHOTS}/system-version-checked-${name}.png`, fullPage: true });
+    });
+
+    test("a newer release GitHub doesn't list yet: no older Update button, and a failed check says so", async ({ page }) => {
+      await setup(page, SELF, {
+        signedIn: true,
+        onlyBlockers: [],
+        version: {
+          latest: null,
+          update_available: false,
+          releases: {
+            fetched_at: Math.floor(Date.now() / 1000) - 600, stale: false, reason: null, error: "GitHub is down",
+            behind: { version: "v1.3.0", reason: "v1.3.0 is out, but GitHub's release list doesn't show it yet; it shows here once it does" },
+          },
+        },
+      });
+      await page.goto("/settings/system/");
+      const status = page.getByTestId("update-status");
+      await expect(status).toHaveAttribute("data-state", "behind");
+      await expect(status).toContainText("v1.3.0 is out");
+      await expect(page.locator("#version").getByRole("button", { name: /^Update/ })).toHaveCount(0);
+      await expect(page.getByTestId("release-check")).toContainText("Checked 10 min ago");
+      await expect(page.getByTestId("release-check-error")).toContainText("couldn't reach GitHub");
+    });
+
     test("up to date: green, with the version", async ({ page }) => {
       await setup(page, SELF, { signedIn: true, version: { latest: null, update_available: false }, onlyBlockers: [] });
       await page.goto("/settings/system/");
 
@@ -199,7 +199,10 @@ function System() {
     setBusy(kind);
     try {
       if (kind === "update") {
-        const r = await api.updateNow(latest?.version, skipCheck);
+        // No version: the updater reads GitHub first and installs the newest
+        // release at this moment. Skipping a model check names the release
+        // whose check the admin read.
+        const r = await api.updateNow(skipCheck ? data.model_check?.version : undefined, skipCheck);
         if (!r.ok) {
           // A model the release calls was refused: show which, with its fix.
           if (r.model_check) setData({ ...data, model_check: r.model_check });
@@ -237,6 +240,7 @@ function System() {
         <SettingsSection id="version" title="Version">
           <div className="min-w-0 space-y-3 px-4 py-4">
             <UpdateStatus data={data} failure={failure} blocked={blocked} busy={busy} onUpdate={() => start("update")} onChanged={load} />
+            {!data.running && !pending && <ReleaseCheck data={data} onChecked={setData} />}
             <SettingsMore summary="Technical details">
               <VersionDetails version={data} autoUpdates={!!data.settings?.auto} failure={failure} />
             </SettingsMore>
@@ -564,6 +568,17 @@ function UpdateStatus({
     );
   }
 
+  const behind = data.releases?.behind;
+  if (behind && current) {
+    return (
+      <div data-testid="update-status" data-state="behind">
+        <Callout variant="info" title={<>{behind.version} is out</>}>
+          <p>You&apos;re on {current}. GitHub&apos;s release list doesn&apos;t show {behind.version} yet, so nothing older is offered meanwhile. It shows here, with Update, once it does: Check for updates in a minute.</p>
+        </Callout>
+      </div>
+    );
+  }
+
   if (!current) {
     return (
       <div data-testid="update-status" data-state="development">
@@ -583,6 +598,46 @@ function UpdateStatus({
   );
 }
 
+/**
+ * When this install last read GitHub's release list, and Check for updates
+ * to read it now (the updater reads at most once per 30 seconds).
+ */
+function ReleaseCheck({ data, onChecked }: { data: SystemVersion; onChecked: (v: SystemVersion) => void }) {
+  const { toast } = useToast();
+  const [checking, setChecking] = useState(false);
+  // "just now" ages into "2 min ago" while the page stays open.
+  const [, tick] = useState(0);
+  useEffect(() => {
+    const t = window.setInterval(() => tick((n) => n + 1), 30_000);
+    return () => window.clearInterval(t);
+  }, []);
+  const r = data.releases;
+  const at = r?.fetched_at ? new Date(r.fetched_at * 1000).toISOString() : null;
+  const check = async () => {
+    setChecking(true);
+    try {
+      onChecked(await api.checkReleases());
+    } catch (e) {
+      toast(e instanceof Error ? e.message : "Could not check for updates", "error");
+    } finally {
+      setChecking(false);
+    }
+  };
+  return (
+    <div data-testid="release-check" className="flex flex-wrap items-center gap-x-3 gap-y-1 text-sm text-zinc-400">
+      <span data-testid="release-checked" aria-live="polite">
+        {checking ? "Checking for updates…" : at ? <>Checked <Time iso={at} /></> : "Not checked yet"}
+      </span>
+      <button type="button" className={buttonClass("secondary", "sm")} onClick={check} disabled={checking}>
+        Check for updates
+      </button>
+      {r?.error && !checking && (
+        <p className="w-full text-amber-300" data-testid="release-check-error">The last check couldn&apos;t reach GitHub, so this is the list from then.</p>
+      )}
+    </div>
+  );
+}
+
 /** Version details: what this version is, how updates arrive, and the facts that tell this install apart (only those known). */
 function VersionDetails({ version, autoUpdates, failure }: { version: SystemVersion; autoUpdates: boolean; failure: FailedTry | null }) {
   const raw = failure?.reason && isRawReason(failure.reason) ? failure.reason : null;
 
@@ -1246,6 +1246,8 @@ export const api = {
   getIntegrations: () => request<IntegrationsResponse>("/api/integrations"),
   /** Self-hosted installs (install admins): this build, the latest release, settings, history. */
   getSystemVersion: () => request<SystemVersion>("/api/system/version"),
+  /** Check for updates: the updater reads GitHub's release list now (at most once per 30 seconds), and answers with the same status. */
+  checkReleases: () => request<SystemVersion>("/api/system/releases/check", { method: "POST", body: "{}" }),
   setAutoUpdate: (settings: Partial<AutoUpdateSettings>) =>
     request<{ settings: AutoUpdateSettings }>("/api/system/auto-update", { method: "PUT", body: JSON.stringify(settings) }),
   /**
@@ -1255,7 +1257,8 @@ export const api = {
   setUninstallMode: (deleteData: boolean, confirm = "") =>
     request<{ ok: boolean; uninstall: UninstallMode }>("/api/system/uninstall-mode", { method: "PUT", body: JSON.stringify({ delete_data: deleteData, confirm }) }),
   /**
-   * Update to `version` (default: the latest). Refused with the model check
+   * Update to `version` (default: the newest release, read from GitHub at
+   * that moment, never the copy the page showed). Refused with the model check
    * when a model the release calls was refused; `skipCheck` passes only a
    * failure on a model the release doesn't call.
    */
@@ -4252,6 +4255,8 @@ export interface SystemVersion {
   current: { version: string | null; commit: string | null; released_at: string | null; config_fingerprint: string | null };
   latest: null | { version: string; notes: string; published_at?: string; url?: string; prerelease?: boolean; breaking: boolean };
   update_available: boolean;
+  /** The release list: when GitHub last answered (unix seconds), and a newer release it doesn't show yet. */
+  releases?: ReleaseFreshness;
   settings?: AutoUpdateSettings;
   running?: boolean;
   history?: UpdateEntry[];
@@ -4265,6 +4270,16 @@ export interface SystemVersion {
   uninstall?: UninstallMode | null;
 }
 
+export interface ReleaseFreshness {
+  fetched_at: number | null;
+  stale: boolean;
+  reason: string | null;
+  /** The last try to read the list failed (GitHub didn't answer); the list is from fetched_at. */
+  error?: string | null;
+  /** A release launch/latest.json names that GitHub's list doesn't show yet: nothing older is offered meanwhile. */
+  behind?: { version: string; reason: string } | null;
+}
+
 export interface UninstallMode {
   delete_data: boolean;
   changed_by: string | null;