diff --git a/apps/microbridge-ui/package-lock.json b/apps/microbridge-ui/package-lock.json
index 0d60e4f..10f219b 100644
--- a/apps/microbridge-ui/package-lock.json
+++ b/apps/microbridge-ui/package-lock.json
@@ -9,7 +9,10 @@
       "version": "0.1.0",
       "dependencies": {
         "@tauri-apps/api": "^2",
+        "@tauri-apps/plugin-dialog": "^2",
+        "@tauri-apps/plugin-process": "^2",
         "@tauri-apps/plugin-shell": "^2",
+        "@tauri-apps/plugin-updater": "^2",
         "react": "^19.0.0",
         "react-dom": "^19.0.0"
       },
@@ -1720,6 +1723,24 @@
         "node": ">= 10"
       }
     },
+    "node_modules/@tauri-apps/plugin-dialog": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.7.1.tgz",
+      "integrity": "sha512-OK1UBXYt+ojcmxMktzzuyonYIFta8CmAASpX+CA+DTGK24KlHjhYI6x2iOJ/TjZF4N7/ACK1oFmEOjIY9IhzOQ==",
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@tauri-apps/api": "^2.11.0"
+      }
+    },
+    "node_modules/@tauri-apps/plugin-process": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-process/-/plugin-process-2.3.1.tgz",
+      "integrity": "sha512-nCa4fGVaDL/B9ai03VyPOjfAHRHSBz5v6F/ObsB73r/dA3MHHhZtldaDMIc0V/pnUw9ehzr2iEG+XkSEyC0JJA==",
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@tauri-apps/api": "^2.8.0"
+      }
+    },
     "node_modules/@tauri-apps/plugin-shell": {
       "version": "2.3.5",
       "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.3.5.tgz",
@@ -1729,6 +1750,15 @@
         "@tauri-apps/api": "^2.10.1"
       }
     },
+    "node_modules/@tauri-apps/plugin-updater": {
+      "version": "2.10.1",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-updater/-/plugin-updater-2.10.1.tgz",
+      "integrity": "sha512-NFYMg+tWOZPJdzE/PpFj2qfqwAWwNS3kXrb1tm1gnBJ9mYzZ4WDRrwy8udzWoAnfGCHLuePNLY1WVCNHnh3eRA==",
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@tauri-apps/api": "^2.10.1"
+      }
+    },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
       "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz",
diff --git a/apps/microbridge-ui/package.json b/apps/microbridge-ui/package.json
index 62bfabf..bc55bf6 100644
--- a/apps/microbridge-ui/package.json
+++ b/apps/microbridge-ui/package.json
@@ -11,7 +11,10 @@
   },
   "dependencies": {
     "@tauri-apps/api": "^2",
+    "@tauri-apps/plugin-dialog": "^2",
+    "@tauri-apps/plugin-process": "^2",
     "@tauri-apps/plugin-shell": "^2",
+    "@tauri-apps/plugin-updater": "^2",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
diff --git a/apps/microbridge-ui/src-tauri/Cargo.lock b/apps/microbridge-ui/src-tauri/Cargo.lock
index f2be747..ae2cb79 100644
--- a/apps/microbridge-ui/src-tauri/Cargo.lock
+++ b/apps/microbridge-ui/src-tauri/Cargo.lock
@@ -47,6 +47,15 @@ version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+dependencies = [
+ "derive_arbitrary",
+]
+
 [[package]]
 name = "atk"
 version = "0.18.2"
@@ -517,6 +526,17 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "derive_arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "derive_more"
 version = "2.1.1"
@@ -762,6 +782,16 @@ dependencies = [
  "rustc_version",
 ]
 
+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -1287,6 +1317,21 @@ dependencies = [
  "want",
 ]
 
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -1555,6 +1600,36 @@ dependencies = [
  "windows-sys 0.45.0",
 ]
 
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys 0.4.1",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.18",
+ "walkdir",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "jni-sys"
 version = "0.3.1"
@@ -1685,6 +1760,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
 [[package]]
 name = "litemap"
 version = "0.8.2"
@@ -1748,7 +1829,10 @@ dependencies = [
  "serde_json",
  "tauri",
  "tauri-build",
+ "tauri-plugin-dialog",
+ "tauri-plugin-process",
  "tauri-plugin-shell",
+ "tauri-plugin-updater",
  "tokio",
 ]
 
@@ -1758,6 +1842,12 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "minisign-verify"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22f9645cb765ea72b8111f36c522475d2daa0d22c957a9826437e97534bc4e9e"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -1990,6 +2080,7 @@ checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
  "bitflags 2.13.1",
  "block2",
+ "libc",
  "objc2",
  "objc2-core-foundation",
 ]
@@ -2005,6 +2096,18 @@ dependencies = [
  "objc2-core-foundation",
 ]
 
+[[package]]
+name = "objc2-osa-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f112d1746737b0da274ef79a23aac283376f335f4095a083a267a082f21db0c0"
+dependencies = [
+ "bitflags 2.13.1",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+]
+
 [[package]]
 name = "objc2-quartz-core"
 version = "0.3.2"
@@ -2079,6 +2182,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -2095,6 +2204,20 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "osakit"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "732c71caeaa72c065bb69d7ea08717bd3f4863a4f451402fc9513e29dbd5261b"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+ "objc2-osa-kit",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "pango"
 version = "0.18.3"
@@ -2455,15 +2578,20 @@ dependencies = [
  "http-body",
  "http-body-util",
  "hyper",
+ "hyper-rustls",
  "hyper-util",
  "js-sys",
  "log",
  "percent-encoding",
  "pin-project-lite",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
  "serde",
  "serde_json",
  "sync_wrapper",
  "tokio",
+ "tokio-rustls",
  "tokio-util",
  "tower",
  "tower-http",
@@ -2475,6 +2603,44 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "rfd"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a15ad77d9e70a92437d8f74c35d99b4e4691128df018833e99f90bcd36152672"
+dependencies = [
+ "block2",
+ "dispatch2",
+ "glib-sys",
+ "gobject-sys",
+ "gtk-sys",
+ "js-sys",
+ "log",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "raw-window-handle",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "rustc-hash"
 version = "2.1.3"
@@ -2490,6 +2656,92 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags 2.13.1",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation",
+ "core-foundation-sys",
+ "jni 0.22.4",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.23"
@@ -2505,6 +2757,15 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "schemars"
 version = "0.8.22"
@@ -2562,6 +2823,29 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.13.1",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
 [[package]]
 name = "selectors"
 version = "0.36.1"
@@ -2814,6 +3098,22 @@ version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
 
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
 [[package]]
 name = "siphasher"
 version = "1.0.3"
@@ -2926,6 +3226,12 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "swift-rs"
 version = "1.0.7"
@@ -3009,7 +3315,7 @@ dependencies = [
  "gdkwayland-sys",
  "gdkx11-sys",
  "gtk",
- "jni",
+ "jni 0.21.1",
  "libc",
  "log",
  "ndk",
@@ -3042,6 +3348,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "tar"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
 [[package]]
 name = "target-lexicon"
 version = "0.12.16"
@@ -3065,7 +3382,7 @@ dependencies = [
  "gtk",
  "heck 0.5.0",
  "http",
- "jni",
+ "jni 0.21.1",
  "libc",
  "log",
  "mime",
@@ -3177,6 +3494,58 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "tauri-plugin-dialog"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65981abb771e74e571a38196c3baa11c459379164791eba0e67abc1a5fac9884"
+dependencies = [
+ "log",
+ "raw-window-handle",
+ "rfd",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "tauri-plugin-fs",
+ "thiserror 2.0.18",
+ "url",
+]
+
+[[package]]
+name = "tauri-plugin-fs"
+version = "2.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7ecc274121aca0c036a2b42d1cbe83d368d348f54e0bb8a735c2b1548e8f371"
+dependencies = [
+ "anyhow",
+ "dunce",
+ "glob",
+ "log",
+ "objc2-foundation",
+ "percent-encoding",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "tauri",
+ "tauri-plugin",
+ "tauri-utils",
+ "thiserror 2.0.18",
+ "toml 1.1.3+spec-1.1.0",
+ "url",
+]
+
+[[package]]
+name = "tauri-plugin-process"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d55511a7bf6cd70c8767b02c97bf8134fa434daf3926cfc1be0a0f94132d165a"
+dependencies = [
+ "tauri",
+ "tauri-plugin",
+]
+
 [[package]]
 name = "tauri-plugin-shell"
 version = "2.3.5"
@@ -3198,6 +3567,39 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tauri-plugin-updater"
+version = "2.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af"
+dependencies = [
+ "base64 0.22.1",
+ "dirs",
+ "flate2",
+ "futures-util",
+ "http",
+ "infer",
+ "log",
+ "minisign-verify",
+ "osakit",
+ "percent-encoding",
+ "reqwest",
+ "rustls",
+ "semver",
+ "serde",
+ "serde_json",
+ "tar",
+ "tauri",
+ "tauri-plugin",
+ "tempfile",
+ "thiserror 2.0.18",
+ "time",
+ "tokio",
+ "url",
+ "windows-sys 0.60.2",
+ "zip",
+]
+
 [[package]]
 name = "tauri-runtime"
 version = "2.11.3"
@@ -3208,7 +3610,7 @@ dependencies = [
  "dpi",
  "gtk",
  "http",
- "jni",
+ "jni 0.21.1",
  "objc2",
  "objc2-ui-kit",
  "objc2-web-kit",
@@ -3231,7 +3633,7 @@ checksum = "4e6fac707727b7a2f48e4ded90976324267371073edbb415ffb73bb0458d203f"
 dependencies = [
  "gtk",
  "http",
- "jni",
+ "jni 0.21.1",
  "log",
  "objc2",
  "objc2-app-kit",
@@ -3298,6 +3700,19 @@ dependencies = [
  "toml 1.1.3+spec-1.1.0",
 ]
 
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "tendril"
 version = "0.5.1"
@@ -3428,6 +3843,16 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.18"
@@ -3718,6 +4143,12 @@ version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -3961,6 +4392,15 @@ dependencies = [
  "system-deps",
 ]
 
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "webview2-com"
 version = "0.38.2"
@@ -4191,6 +4631,15 @@ dependencies = [
  "windows-targets 0.42.2",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.59.0"
@@ -4486,7 +4935,7 @@ dependencies = [
  "gtk",
  "http",
  "javascriptcore-rs",
- "jni",
+ "jni 0.21.1",
  "libc",
  "ndk",
  "objc2",
@@ -4533,6 +4982,16 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.3"
@@ -4577,6 +5036,12 @@ dependencies = [
  "synstructure",
 ]
 
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
 [[package]]
 name = "zerotrie"
 version = "0.2.4"
@@ -4610,6 +5075,18 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "zip"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "indexmap 2.14.0",
+ "memchr",
+]
+
 [[package]]
 name = "zmij"
 version = "1.0.23"
diff --git a/apps/microbridge-ui/src-tauri/Cargo.toml b/apps/microbridge-ui/src-tauri/Cargo.toml
index 20e79f3..1ddf245 100644
--- a/apps/microbridge-ui/src-tauri/Cargo.toml
+++ b/apps/microbridge-ui/src-tauri/Cargo.toml
@@ -15,6 +15,9 @@ tauri-build = { version = "2", features = [] }
 [dependencies]
 tauri = { version = "2", features = ["tray-icon", "macos-private-api"] }
 tauri-plugin-shell = "2"
+tauri-plugin-updater = "2"
+tauri-plugin-process = "2"
+tauri-plugin-dialog = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "io-util", "sync"] }
diff --git a/apps/microbridge-ui/src-tauri/capabilities/default.json b/apps/microbridge-ui/src-tauri/capabilities/default.json
index 641a6fd..634734d 100644
--- a/apps/microbridge-ui/src-tauri/capabilities/default.json
+++ b/apps/microbridge-ui/src-tauri/capabilities/default.json
@@ -13,6 +13,10 @@
     "core:window:allow-outer-size",
     "core:window:allow-close",
     "core:app:allow-default-window-icon",
-    "shell:allow-open"
+    "shell:allow-open",
+    "updater:default",
+    "process:allow-restart",
+    "dialog:allow-ask",
+    "dialog:allow-message"
   ]
 }
diff --git a/apps/microbridge-ui/src-tauri/src/lib.rs b/apps/microbridge-ui/src-tauri/src/lib.rs
index a6a14ce..064c196 100644
--- a/apps/microbridge-ui/src-tauri/src/lib.rs
+++ b/apps/microbridge-ui/src-tauri/src/lib.rs
@@ -155,10 +155,54 @@ fn quit_ui(app: AppHandle) {
     app.exit(0);
 }
 
+/// Install channel of the running app. Homebrew drops a `.microbridge-brew`
+/// marker at the bundle root (see the formula's `post_install`); its absence
+/// means a DMG/manual install. The in-app self-updater only replaces `direct`
+/// installs — brew copies are routed to `brew upgrade` so the formula version
+/// and the on-disk bundle never drift apart.
+#[tauri::command]
+fn update_channel() -> String {
+    if brew_marker_present() {
+        "brew".into()
+    } else {
+        "direct".into()
+    }
+}
+
+/// True when the running bundle carries Homebrew's ownership marker.
+/// `…/Microbridge.app/Contents/MacOS/microbridge-ui` → the bundle root is the
+/// third ancestor of the executable.
+fn brew_marker_present() -> bool {
+    let Ok(exe) = std::env::current_exe() else {
+        return false;
+    };
+    match exe.ancestors().nth(3) {
+        Some(bundle) => bundle.join(".microbridge-brew").exists(),
+        None => false,
+    }
+}
+
+/// App version, read from the bundle metadata (single source of truth in
+/// `tauri.conf.json`). Shown on the Updates settings tab.
+#[tauri::command]
+fn app_version(app: AppHandle) -> String {
+    app.package_info().version.to_string()
+}
+
+/// Ask the frontend to run a user-initiated update check. The check / prompt /
+/// download / relaunch flow lives in the always-loaded popover webview and
+/// shows native dialogs via the dialog plugin.
+fn trigger_update_check(app: &AppHandle) {
+    let _ = app.emit("menu://check-updates", ());
+}
+
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
     tauri::Builder::default()
         .plugin(tauri_plugin_shell::init())
+        .plugin(tauri_plugin_updater::Builder::new().build())
+        .plugin(tauri_plugin_process::init())
+        .plugin(tauri_plugin_dialog::init())
         .setup(|app| {
             #[cfg(target_os = "macos")]
             {
@@ -233,6 +277,13 @@ pub fn run() {
 
             // Right-click context menu. Left-click still toggles the popover
             // (`show_menu_on_left_click(false)` keeps the menu on right-click only).
+            let check_updates_item = MenuItem::with_id(
+                app,
+                "check-updates",
+                "Check for Updates…",
+                true,
+                None::<&str>,
+            )?;
             let settings_item =
                 MenuItem::with_id(app, "settings", "Settings…", true, None::<&str>)?;
             let quit_item =
@@ -240,6 +291,7 @@ pub fn run() {
             let tray_menu = Menu::with_items(
                 app,
                 &[
+                    &check_updates_item,
                     &settings_item,
                     &PredefinedMenuItem::separator(app)?,
                     &quit_item,
@@ -253,6 +305,7 @@ pub fn run() {
                 .menu(&tray_menu)
                 .show_menu_on_left_click(false)
                 .on_menu_event(|app, event| match event.id.as_ref() {
+                    "check-updates" => trigger_update_check(app),
                     "settings" => show_settings_window(app),
                     "quit" => app.exit(0),
                     _ => {}
@@ -303,7 +356,9 @@ pub fn run() {
             open_settings,
             close_settings,
             hide_popover,
-            quit_ui
+            quit_ui,
+            update_channel,
+            app_version
         ])
         .run(tauri::generate_context!())
         .expect("error while running microbridge-ui");
diff --git a/apps/microbridge-ui/src-tauri/tauri.conf.json b/apps/microbridge-ui/src-tauri/tauri.conf.json
index 524f0d1..0b28346 100644
--- a/apps/microbridge-ui/src-tauri/tauri.conf.json
+++ b/apps/microbridge-ui/src-tauri/tauri.conf.json
@@ -58,6 +58,14 @@
       "csp": null
     }
   },
+  "plugins": {
+    "updater": {
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDdGRDZGMDQzOEYxODUxN0UKUldSK1VSaVBRL0RXZjdTajFUWnlGbW9USnkyVGp4SXBRM2JvZjZyWUdia0ZWK2UvNE5Fd0dQM3MK",
+      "endpoints": [
+        "https://github.com/DevVig/microbridge/releases/latest/download/latest.json"
+      ]
+    }
+  },
   "bundle": {
     "active": true,
     "targets": "all",
diff --git a/apps/microbridge-ui/src/App.tsx b/apps/microbridge-ui/src/App.tsx
index 8690527..95f7670 100644
--- a/apps/microbridge-ui/src/App.tsx
+++ b/apps/microbridge-ui/src/App.tsx
@@ -8,12 +8,13 @@ import {
 } from "./lib/bus";
 import { resolveAppearance } from "./lib/theme";
 import type { DaemonConfig, Snapshot } from "./lib/types";
+import { autoCheckEnabled, runUpdateCheck } from "./lib/updater";
 import { Hud } from "./surfaces/Hud";
 import { Popover } from "./surfaces/Popover";
 import { Settings } from "./surfaces/Settings";
 
 type View = "popover" | "settings" | "hud";
-type SettingsTab = "keys" | "agent" | "adapters" | "device";
+type SettingsTab = "keys" | "agent" | "adapters" | "device" | "updates";
 
 function initialView(): View {
   const q = new URLSearchParams(window.location.search).get("view");
@@ -40,6 +41,37 @@ export default function App() {
     };
   }, []);
 
+  // Updates run only from the popover (always loaded) so they fire once, not
+  // once per window. The tray "Check for Updates…" item emits the event; the
+  // opt-in launch check is silent so a current install shows nothing.
+  useEffect(() => {
+    if (view !== "popover") return;
+    let disposed = false;
+    let unlisten: (() => void) | undefined;
+
+    if (autoCheckEnabled()) {
+      void runUpdateCheck({ silent: true });
+    }
+
+    void (async () => {
+      try {
+        const { listen } = await import("@tauri-apps/api/event");
+        const un = await listen("menu://check-updates", () => {
+          void runUpdateCheck({ silent: false });
+        });
+        if (disposed) un();
+        else unlisten = un;
+      } catch {
+        /* not running under Tauri */
+      }
+    })();
+
+    return () => {
+      disposed = true;
+      unlisten?.();
+    };
+  }, [view]);
+
   if (!snapshot) {
     return (
       <div
diff --git a/apps/microbridge-ui/src/lib/updater.ts b/apps/microbridge-ui/src/lib/updater.ts
new file mode 100644
index 0000000..14af5d7
--- /dev/null
+++ b/apps/microbridge-ui/src/lib/updater.ts
@@ -0,0 +1,116 @@
+/**
+ * In-app updates for direct (DMG) installs.
+ *
+ * User-initiated by default (tray "Check for Updates…" / Settings button); an
+ * opt-in toggle also runs one silent check at launch. Channel-aware: Homebrew
+ * installs are routed to `brew upgrade` and never self-replaced, so the two
+ * update paths can't drift. Every Tauri import is dynamic + guarded so the
+ * browser/demo build (no Tauri runtime) degrades to a no-op.
+ */
+
+const AUTO_CHECK_KEY = "microbridge.autoCheckUpdates";
+
+/** Opt-in launch check — defaults off to honor "no update pings" by default. */
+export function autoCheckEnabled(): boolean {
+  try {
+    return localStorage.getItem(AUTO_CHECK_KEY) === "1";
+  } catch {
+    return false;
+  }
+}
+
+export function setAutoCheckEnabled(value: boolean): void {
+  try {
+    localStorage.setItem(AUTO_CHECK_KEY, value ? "1" : "0");
+  } catch {
+    /* no persistent storage — nothing to do */
+  }
+}
+
+async function invokeCmd<T>(cmd: string): Promise<T | null> {
+  try {
+    const { invoke } = await import("@tauri-apps/api/core");
+    return await invoke<T>(cmd);
+  } catch {
+    return null;
+  }
+}
+
+export type UpdateChannel = "brew" | "direct";
+
+/** `"brew"` when Homebrew manages this bundle, else `"direct"`. */
+export async function updateChannel(): Promise<UpdateChannel | null> {
+  return await invokeCmd<UpdateChannel>("update_channel");
+}
+
+export async function appVersion(): Promise<string | null> {
+  return await invokeCmd<string>("app_version");
+}
+
+/**
+ * Run a channel-aware update check.
+ *
+ * `silent` suppresses the "up to date" and Homebrew dialogs — used by the
+ * opt-in launch check so a current install shows nothing. Never throws; a
+ * network error, a missing manifest, or an absent Tauri runtime resolves to a
+ * quiet no-op (or a soft warning when not silent).
+ */
+export async function runUpdateCheck({
+  silent,
+}: {
+  silent: boolean;
+}): Promise<void> {
+  try {
+    // Homebrew owns this bundle — defer to brew, never self-replace.
+    if ((await updateChannel()) === "brew") {
+      if (!silent) {
+        const { message } = await import("@tauri-apps/plugin-dialog");
+        await message(
+          "Microbridge was installed with Homebrew.\n\nUpdate it from Terminal:\n\n    brew update && brew upgrade microbridge",
+          { title: "Update Microbridge", kind: "info" },
+        );
+      }
+      return;
+    }
+
+    const { check } = await import("@tauri-apps/plugin-updater");
+    const update = await check();
+
+    if (!update) {
+      if (!silent) {
+        const { message } = await import("@tauri-apps/plugin-dialog");
+        await message("You're on the latest version.", {
+          title: "Microbridge",
+          kind: "info",
+        });
+      }
+      return;
+    }
+
+    const { ask } = await import("@tauri-apps/plugin-dialog");
+    const notes = update.body ? `\n\n${update.body}` : "";
+    const proceed = await ask(`Version ${update.version} is available.${notes}`, {
+      title: "Update Microbridge",
+      kind: "info",
+      okLabel: "Install & Restart",
+      cancelLabel: "Later",
+    });
+    if (!proceed) return;
+
+    await update.downloadAndInstall();
+    const { relaunch } = await import("@tauri-apps/plugin-process");
+    await relaunch();
+  } catch {
+    if (!silent) {
+      try {
+        const { message } = await import("@tauri-apps/plugin-dialog");
+        await message(
+          "Couldn't check for updates right now. Please try again later.",
+          { title: "Microbridge", kind: "warning" },
+        );
+      } catch {
+        /* dialog plugin unavailable — nothing to show */
+      }
+    }
+  }
+}
diff --git a/apps/microbridge-ui/src/surfaces/Settings.tsx b/apps/microbridge-ui/src/surfaces/Settings.tsx
index 82d7e87..7f27db1 100644
--- a/apps/microbridge-ui/src/surfaces/Settings.tsx
+++ b/apps/microbridge-ui/src/surfaces/Settings.tsx
@@ -1,7 +1,15 @@
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import type { DaemonConfig, Snapshot } from "../lib/types";
 import { STATE_COLORS, STATE_LABELS } from "../lib/types";
 import { DARK, LIGHT } from "../lib/theme";
+import {
+  appVersion,
+  autoCheckEnabled,
+  runUpdateCheck,
+  setAutoCheckEnabled,
+  updateChannel,
+  type UpdateChannel,
+} from "../lib/updater";
 import {
   controlInspector,
   DeviceTwin,
@@ -40,7 +48,7 @@ const KEY_SOURCES: {
   },
 ];
 
-type Tab = "keys" | "agent" | "adapters" | "device";
+type Tab = "keys" | "agent" | "adapters" | "device" | "updates";
 
 export function Settings({
   snapshot,
@@ -64,11 +72,21 @@ export function Settings({
     ? controlInspector(selected, snapshot)
     : null;
 
+  const [version, setVersion] = useState<string | null>(null);
+  const [channel, setChannel] = useState<UpdateChannel | null>(null);
+  const [autoCheck, setAutoCheck] = useState<boolean>(() => autoCheckEnabled());
+
+  useEffect(() => {
+    void appVersion().then(setVersion);
+    void updateChannel().then(setChannel);
+  }, []);
+
   const tabs: { id: Tab; label: string }[] = [
     { id: "keys", label: "Keys" },
     { id: "agent", label: "Agent Keys" },
     { id: "adapters", label: "Adapters" },
     { id: "device", label: "Device" },
+    { id: "updates", label: "Updates" },
   ];
 
   return (
@@ -445,6 +463,74 @@ export function Settings({
             </ul>
           </section>
         )}
+
+        {tab === "updates" && (
+          <section>
+            <h1 className="text-[18px] font-semibold">Updates</h1>
+            <p className="mt-1 text-[12.5px]" style={{ color: t.textSecondary }}>
+              The daemon stays zero-network. This is the only place Microbridge
+              reaches out — and only when you ask it to.
+            </p>
+
+            <div
+              className="mt-5 rounded-2xl p-4"
+              style={{
+                backgroundColor: t.panel,
+                border: `1px solid ${t.hairline}`,
+              }}
+            >
+              <div className="flex items-center justify-between">
+                <div>
+                  <div className="text-[12.5px] font-medium">
+                    Microbridge {version ? `v${version}` : ""}
+                  </div>
+                  <div
+                    className="mt-0.5 text-[11px]"
+                    style={{ color: t.textSecondary }}
+                  >
+                    {channel === "brew"
+                      ? "Managed by Homebrew — brew upgrade microbridge"
+                      : channel === "direct"
+                        ? "Direct install — updates in place"
+                        : "Checking install type…"}
+                  </div>
+                </div>
+                <button
+                  type="button"
+                  onClick={() => void runUpdateCheck({ silent: false })}
+                  className="rounded-lg px-3 py-1.5 text-[12px] font-medium"
+                  style={{
+                    backgroundColor: t.hoverBg,
+                    color: t.text,
+                    border: `1px solid ${t.hairline}`,
+                  }}
+                >
+                  Check for Updates
+                </button>
+              </div>
+            </div>
+
+            <label className="mt-4 flex items-center gap-2 text-[12.5px]">
+              <input
+                type="checkbox"
+                checked={autoCheck}
+                onChange={(e) => {
+                  setAutoCheck(e.target.checked);
+                  setAutoCheckEnabled(e.target.checked);
+                }}
+              />
+              Check for updates automatically when Microbridge starts
+            </label>
+            <p
+              className="mt-2 max-w-md text-[11px]"
+              style={{ color: t.textMuted }}
+            >
+              Off by default. When on, Microbridge quietly checks once at launch
+              and only speaks up if an update is ready. No background polling,
+              ever.
+            </p>
+          </section>
+        )}
       </main>
     </div>
   );