diff --git a/.github/workflows/install-smoke.yml b/.github/workflows/install-smoke.yml
index ccacbd52e36..3dcfeb7c2d9 100644
--- a/.github/workflows/install-smoke.yml
+++ b/.github/workflows/install-smoke.yml
@@ -194,6 +194,13 @@ jobs:
           push: false
           provenance: false
 
+      - name: Setup Node environment for local pack smoke
+        uses: ./.github/actions/setup-node-env
+        with:
+          install-bun: "false"
+          install-deps: "true"
+          use-sticky-disk: "false"
+
       - name: Run installer docker tests
         env:
           OPENCLAW_INSTALL_URL: https://openclaw.ai/install.sh
diff --git a/scripts/docker/install-sh-smoke/run.sh b/scripts/docker/install-sh-smoke/run.sh
index 0e37abf671f..2dc35b2e474 100755
--- a/scripts/docker/install-sh-smoke/run.sh
+++ b/scripts/docker/install-sh-smoke/run.sh
@@ -2,26 +2,31 @@
 set -euo pipefail
 
 INSTALL_URL="${OPENCLAW_INSTALL_URL:-https://openclaw.bot/install.sh}"
+SMOKE_MODE="${OPENCLAW_INSTALL_SMOKE_MODE:-install}"
 SMOKE_PREVIOUS_VERSION="${OPENCLAW_INSTALL_SMOKE_PREVIOUS:-}"
 SKIP_PREVIOUS="${OPENCLAW_INSTALL_SMOKE_SKIP_PREVIOUS:-0}"
 DEFAULT_PACKAGE="openclaw"
 PACKAGE_NAME="${OPENCLAW_INSTALL_PACKAGE:-$DEFAULT_PACKAGE}"
+UPDATE_BASELINE_VERSION="${OPENCLAW_INSTALL_UPDATE_BASELINE:-2026.4.10}"
+UPDATE_EXPECT_VERSION="${OPENCLAW_INSTALL_UPDATE_EXPECT_VERSION:-}"
+UPDATE_TAG_URL="${OPENCLAW_INSTALL_UPDATE_TAG_URL:-}"
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 
 # shellcheck source=../install-sh-common/cli-verify.sh
 source "$SCRIPT_DIR/../install-sh-common/cli-verify.sh"
 
-echo "==> Resolve npm versions"
-if [[ "$SKIP_PREVIOUS" == "1" ]]; then
-  LATEST_VERSION="$(quiet_npm view "$PACKAGE_NAME" version)"
-  PREVIOUS_VERSION="$LATEST_VERSION"
-elif [[ -n "$SMOKE_PREVIOUS_VERSION" ]]; then
-  LATEST_VERSION="$(quiet_npm view "$PACKAGE_NAME" version)"
-  PREVIOUS_VERSION="$SMOKE_PREVIOUS_VERSION"
-else
-  LATEST_VERSION="$(quiet_npm view "$PACKAGE_NAME" dist-tags.latest)"
-  VERSIONS_JSON="$(quiet_npm view "$PACKAGE_NAME" versions --json)"
-  PREVIOUS_VERSION="$(LATEST_VERSION="$LATEST_VERSION" VERSIONS_JSON="$VERSIONS_JSON" node - <<'NODE'
+run_install_smoke() {
+  echo "==> Resolve npm versions"
+  if [[ "$SKIP_PREVIOUS" == "1" ]]; then
+    LATEST_VERSION="$(quiet_npm view "$PACKAGE_NAME" version)"
+    PREVIOUS_VERSION="$LATEST_VERSION"
+  elif [[ -n "$SMOKE_PREVIOUS_VERSION" ]]; then
+    LATEST_VERSION="$(quiet_npm view "$PACKAGE_NAME" version)"
+    PREVIOUS_VERSION="$SMOKE_PREVIOUS_VERSION"
+  else
+    LATEST_VERSION="$(quiet_npm view "$PACKAGE_NAME" dist-tags.latest)"
+    VERSIONS_JSON="$(quiet_npm view "$PACKAGE_NAME" versions --json)"
+    PREVIOUS_VERSION="$(LATEST_VERSION="$LATEST_VERSION" VERSIONS_JSON="$VERSIONS_JSON" node - <<'NODE'
 const latest = String(process.env.LATEST_VERSION || "");
 const raw = process.env.VERSIONS_JSON || "[]";
 let versions;
@@ -44,24 +49,101 @@ if (latestIndex <= 0) {
 process.stdout.write(String(versions[latestIndex - 1] ?? latest));
 NODE
 )"
-fi
+  fi
 
-echo "package=$PACKAGE_NAME latest=$LATEST_VERSION previous=$PREVIOUS_VERSION"
+  echo "package=$PACKAGE_NAME latest=$LATEST_VERSION previous=$PREVIOUS_VERSION"
 
-if [[ "$SKIP_PREVIOUS" == "1" ]]; then
-  echo "==> Skip preinstall previous (OPENCLAW_INSTALL_SMOKE_SKIP_PREVIOUS=1)"
-else
-  echo "==> Preinstall previous (forces installer upgrade path)"
-  quiet_npm install -g "${PACKAGE_NAME}@${PREVIOUS_VERSION}"
-fi
+  if [[ "$SKIP_PREVIOUS" == "1" ]]; then
+    echo "==> Skip preinstall previous (OPENCLAW_INSTALL_SMOKE_SKIP_PREVIOUS=1)"
+  else
+    echo "==> Preinstall previous (forces installer upgrade path)"
+    quiet_npm install -g "${PACKAGE_NAME}@${PREVIOUS_VERSION}"
+  fi
 
-echo "==> Run official installer one-liner"
-curl -fsSL "$INSTALL_URL" | bash -s -- --no-prompt
+  echo "==> Run official installer one-liner"
+  curl -fsSL "$INSTALL_URL" | bash -s -- --no-prompt
 
-echo "==> Verify installed version"
-if [[ -n "${OPENCLAW_INSTALL_LATEST_OUT:-}" ]]; then
-  printf "%s" "$LATEST_VERSION" > "${OPENCLAW_INSTALL_LATEST_OUT:-}"
-fi
-verify_installed_cli "$PACKAGE_NAME" "$LATEST_VERSION"
+  echo "==> Verify installed version"
+  if [[ -n "${OPENCLAW_INSTALL_LATEST_OUT:-}" ]]; then
+    printf "%s" "$LATEST_VERSION" > "${OPENCLAW_INSTALL_LATEST_OUT:-}"
+  fi
+  verify_installed_cli "$PACKAGE_NAME" "$LATEST_VERSION"
 
-echo "OK"
+  echo "OK"
+}
+
+run_update_smoke() {
+  if [[ -z "$UPDATE_EXPECT_VERSION" ]]; then
+    echo "ERROR: OPENCLAW_INSTALL_UPDATE_EXPECT_VERSION is required for update mode" >&2
+    return 1
+  fi
+  if [[ -z "$UPDATE_TAG_URL" ]]; then
+    echo "ERROR: OPENCLAW_INSTALL_UPDATE_TAG_URL is required for update mode" >&2
+    return 1
+  fi
+
+  echo "package=$PACKAGE_NAME baseline=$UPDATE_BASELINE_VERSION target=$UPDATE_EXPECT_VERSION"
+  echo "==> Install baseline release"
+  quiet_npm install -g "${PACKAGE_NAME}@${UPDATE_BASELINE_VERSION}"
+  verify_installed_cli "$PACKAGE_NAME" "$UPDATE_BASELINE_VERSION"
+
+  echo "==> Run openclaw update from host-served tgz"
+  UPDATE_JSON="$(openclaw update --tag "$UPDATE_TAG_URL" --yes --json)"
+  printf "%s\n" "$UPDATE_JSON"
+
+  UPDATE_JSON="$UPDATE_JSON" \
+    UPDATE_EXPECT_VERSION="$UPDATE_EXPECT_VERSION" \
+    UPDATE_BASELINE_VERSION="$UPDATE_BASELINE_VERSION" \
+    UPDATE_TAG_URL="$UPDATE_TAG_URL" \
+    node - <<'NODE'
+const payload = JSON.parse(process.env.UPDATE_JSON || "{}");
+const expectedVersion = String(process.env.UPDATE_EXPECT_VERSION || "");
+const baselineVersion = String(process.env.UPDATE_BASELINE_VERSION || "");
+const expectedUrl = String(process.env.UPDATE_TAG_URL || "");
+if (payload.status !== "ok") {
+  throw new Error(`expected update status ok, got ${JSON.stringify(payload.status)}`);
+}
+if ((payload.before?.version ?? null) !== baselineVersion) {
+  throw new Error(
+    `expected before.version ${baselineVersion}, got ${JSON.stringify(payload.before?.version)}`,
+  );
+}
+if ((payload.after?.version ?? null) !== expectedVersion) {
+  throw new Error(
+    `expected after.version ${expectedVersion}, got ${JSON.stringify(payload.after?.version)}`,
+  );
+}
+if (payload.reason != null) {
+  throw new Error(`expected no failure reason, got ${JSON.stringify(payload.reason)}`);
+}
+const steps = Array.isArray(payload.steps) ? payload.steps : [];
+const updateStep = steps.find((step) => step?.name === "global update");
+if (!updateStep) {
+  throw new Error("missing global update step in update JSON");
+}
+if (Number(updateStep.exitCode ?? 1) !== 0) {
+  throw new Error(`global update step failed: ${JSON.stringify(updateStep)}`);
+}
+if (typeof updateStep.command !== "string" || !updateStep.command.includes(expectedUrl)) {
+  throw new Error(`global update step missing expected tgz URL: ${JSON.stringify(updateStep)}`);
+}
+NODE
+
+  echo "==> Verify updated version"
+  verify_installed_cli "$PACKAGE_NAME" "$UPDATE_EXPECT_VERSION"
+
+  echo "OK"
+}
+
+case "$SMOKE_MODE" in
+  install)
+    run_install_smoke
+    ;;
+  update)
+    run_update_smoke
+    ;;
+  *)
+    echo "ERROR: unsupported OPENCLAW_INSTALL_SMOKE_MODE=$SMOKE_MODE" >&2
+    exit 1
+    ;;
+esac
diff --git a/scripts/test-install-sh-docker.sh b/scripts/test-install-sh-docker.sh
index b0ad01fdd3e..ae65a58c992 100755
--- a/scripts/test-install-sh-docker.sh
+++ b/scripts/test-install-sh-docker.sh
@@ -2,17 +2,124 @@
 set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=./docker/install-sh-common/version-parse.sh
+source "$ROOT_DIR/scripts/docker/install-sh-common/version-parse.sh"
+
 SMOKE_IMAGE="${OPENCLAW_INSTALL_SMOKE_IMAGE:-openclaw-install-smoke:local}"
 NONROOT_IMAGE="${OPENCLAW_INSTALL_NONROOT_IMAGE:-openclaw-install-nonroot:local}"
 SMOKE_PLATFORM="${OPENCLAW_INSTALL_SMOKE_PLATFORM:-linux/amd64}"
 NONROOT_PLATFORM="${OPENCLAW_INSTALL_NONROOT_PLATFORM:-$SMOKE_PLATFORM}"
 INSTALL_URL="${OPENCLAW_INSTALL_URL:-https://openclaw.bot/install.sh}"
 CLI_INSTALL_URL="${OPENCLAW_INSTALL_CLI_URL:-https://openclaw.bot/install-cli.sh}"
+PACKAGE_NAME="${OPENCLAW_INSTALL_PACKAGE:-openclaw}"
 SKIP_NONROOT="${OPENCLAW_INSTALL_SMOKE_SKIP_NONROOT:-0}"
 SKIP_SMOKE_IMAGE_BUILD="${OPENCLAW_INSTALL_SMOKE_SKIP_IMAGE_BUILD:-0}"
 SKIP_NONROOT_IMAGE_BUILD="${OPENCLAW_INSTALL_NONROOT_SKIP_IMAGE_BUILD:-0}"
+SKIP_UPDATE="${OPENCLAW_INSTALL_SMOKE_SKIP_UPDATE:-0}"
+UPDATE_BASELINE_VERSION="${OPENCLAW_INSTALL_SMOKE_UPDATE_BASELINE:-2026.4.10}"
+UPDATE_PACKAGE_SPEC="${OPENCLAW_INSTALL_SMOKE_UPDATE_PACKAGE_SPEC:-}"
+UPDATE_SKIP_LOCAL_BUILD="${OPENCLAW_INSTALL_SMOKE_UPDATE_SKIP_LOCAL_BUILD:-0}"
+UPDATE_HOST_ALIAS="${OPENCLAW_INSTALL_SMOKE_UPDATE_HOST:-host.docker.internal}"
+UPDATE_PORT="${OPENCLAW_INSTALL_SMOKE_UPDATE_PORT:-}"
 LATEST_DIR="$(mktemp -d)"
 LATEST_FILE="${LATEST_DIR}/latest"
+UPDATE_DIR="$(mktemp -d)"
+UPDATE_SERVER_PID=""
+UPDATE_SERVER_LOG="${UPDATE_DIR}/http.log"
+UPDATE_TGZ_FILE=""
+UPDATE_EXPECT_VERSION=""
+UPDATE_TAG_URL=""
+UPDATE_DOCKER_HOST_ARGS=()
+
+cleanup() {
+  if [[ -n "$UPDATE_SERVER_PID" ]]; then
+    kill "$UPDATE_SERVER_PID" >/dev/null 2>&1 || true
+    wait "$UPDATE_SERVER_PID" >/dev/null 2>&1 || true
+  fi
+  rm -rf "$LATEST_DIR" "$UPDATE_DIR"
+}
+
+trap cleanup EXIT
+
+allocate_host_port() {
+  node -e '
+    const net = require("node:net");
+    const server = net.createServer();
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        process.exit(1);
+      }
+      process.stdout.write(String(address.port));
+      server.close();
+    });
+  '
+}
+
+prepare_update_tarball() {
+  local pack_json
+  if [[ -n "$UPDATE_PACKAGE_SPEC" ]]; then
+    echo "==> Pack update tgz from spec: $UPDATE_PACKAGE_SPEC"
+    if [[ -z "$UPDATE_EXPECT_VERSION" ]]; then
+      echo "ERROR: OPENCLAW_INSTALL_SMOKE_UPDATE_EXPECT_VERSION is required with OPENCLAW_INSTALL_SMOKE_UPDATE_PACKAGE_SPEC" >&2
+      exit 1
+    fi
+    pack_json="$(
+      quiet_npm pack "$UPDATE_PACKAGE_SPEC" --json --pack-destination "$UPDATE_DIR"
+    )"
+  else
+    echo "==> Build local release artifacts for update smoke"
+    if [[ "$UPDATE_SKIP_LOCAL_BUILD" != "1" ]]; then
+      pnpm build
+      pnpm ui:build
+    fi
+    UPDATE_EXPECT_VERSION="$(
+      node -p 'JSON.parse(require("node:fs").readFileSync("package.json", "utf8")).version'
+    )"
+    pack_json="$(
+      quiet_npm pack --ignore-scripts --json --pack-destination "$UPDATE_DIR"
+    )"
+  fi
+  UPDATE_TGZ_FILE="$(
+    PACK_JSON="$pack_json" node - <<'NODE'
+const raw = process.env.PACK_JSON || "[]";
+const parsed = JSON.parse(raw);
+const last = Array.isArray(parsed) ? parsed.at(-1) : null;
+if (!last || typeof last.filename !== "string" || last.filename.length === 0) {
+  process.exit(1);
+}
+process.stdout.write(last.filename);
+NODE
+  )"
+}
+
+prepare_update_host_access() {
+  local host_os
+  host_os="$(uname -s)"
+  UPDATE_DOCKER_HOST_ARGS=()
+  if [[ "$host_os" == "Linux" ]]; then
+    UPDATE_DOCKER_HOST_ARGS=(--add-host "${UPDATE_HOST_ALIAS}:host-gateway")
+  fi
+}
+
+start_update_server() {
+  if [[ -z "$UPDATE_PORT" ]]; then
+    UPDATE_PORT="$(allocate_host_port)"
+  fi
+  UPDATE_TAG_URL="http://${UPDATE_HOST_ALIAS}:${UPDATE_PORT}/${UPDATE_TGZ_FILE}"
+  echo "==> Serve update tgz: $UPDATE_TAG_URL"
+  (
+    cd "$UPDATE_DIR"
+    exec python3 -m http.server "$UPDATE_PORT" --bind 0.0.0.0
+  ) >"$UPDATE_SERVER_LOG" 2>&1 &
+  UPDATE_SERVER_PID=$!
+  sleep 1
+  if ! kill -0 "$UPDATE_SERVER_PID" >/dev/null 2>&1; then
+    echo "ERROR: failed to start update tgz server" >&2
+    tail -n 50 "$UPDATE_SERVER_LOG" >&2 || true
+    exit 1
+  fi
+}
 
 if [[ "$SKIP_SMOKE_IMAGE_BUILD" == "1" ]]; then
   echo "==> Reuse prebuilt smoke image: $SMOKE_IMAGE"
@@ -30,6 +137,7 @@ docker run --rm -t \
   --platform "$SMOKE_PLATFORM" \
   -v "${LATEST_DIR}:/out" \
   -e OPENCLAW_INSTALL_URL="$INSTALL_URL" \
+  -e OPENCLAW_INSTALL_PACKAGE="$PACKAGE_NAME" \
   -e OPENCLAW_INSTALL_METHOD=npm \
   -e OPENCLAW_INSTALL_LATEST_OUT="/out/latest" \
   -e OPENCLAW_INSTALL_SMOKE_PREVIOUS="${OPENCLAW_INSTALL_SMOKE_PREVIOUS:-}" \
@@ -44,6 +152,28 @@ if [[ -f "$LATEST_FILE" ]]; then
   LATEST_VERSION="$(cat "$LATEST_FILE")"
 fi
 
+if [[ "$SKIP_UPDATE" == "1" ]]; then
+  echo "==> Skip update smoke (OPENCLAW_INSTALL_SMOKE_SKIP_UPDATE=1)"
+else
+  prepare_update_tarball
+  prepare_update_host_access
+  start_update_server
+
+  echo "==> Run update smoke (${UPDATE_BASELINE_VERSION} -> ${UPDATE_EXPECT_VERSION})"
+  docker run --rm -t \
+    --platform "$SMOKE_PLATFORM" \
+    "${UPDATE_DOCKER_HOST_ARGS[@]}" \
+    -e OPENCLAW_INSTALL_PACKAGE="$PACKAGE_NAME" \
+    -e OPENCLAW_INSTALL_SMOKE_MODE=update \
+    -e OPENCLAW_INSTALL_UPDATE_BASELINE="$UPDATE_BASELINE_VERSION" \
+    -e OPENCLAW_INSTALL_UPDATE_EXPECT_VERSION="$UPDATE_EXPECT_VERSION" \
+    -e OPENCLAW_INSTALL_UPDATE_TAG_URL="$UPDATE_TAG_URL" \
+    -e OPENCLAW_NO_ONBOARD=1 \
+    -e OPENCLAW_NO_PROMPT=1 \
+    -e DEBIAN_FRONTEND=noninteractive \
+    "$SMOKE_IMAGE"
+fi
+
 if [[ "$SKIP_NONROOT" == "1" ]]; then
   echo "==> Skip non-root installer smoke (OPENCLAW_INSTALL_SMOKE_SKIP_NONROOT=1)"
 else
@@ -62,6 +192,7 @@ else
   docker run --rm -t \
     --platform "$NONROOT_PLATFORM" \
     -e OPENCLAW_INSTALL_URL="$INSTALL_URL" \
+    -e OPENCLAW_INSTALL_PACKAGE="$PACKAGE_NAME" \
     -e OPENCLAW_INSTALL_METHOD=npm \
     -e OPENCLAW_INSTALL_EXPECT_VERSION="$LATEST_VERSION" \
     -e OPENCLAW_NO_ONBOARD=1 \