diff --git a/deploy/update.sh b/deploy/update.sh
new file mode 100755
index 0000000..ae2289a
--- /dev/null
+++ b/deploy/update.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Update kgva's core CMS in place (RUN ON CT130). Pulls latest kgva main (incl. the
+# vendored cms/core), rebuilds the image, restarts. Build succeeds BEFORE the old
+# container is removed → a failed build leaves the live site untouched.
+# NOTE: with GIT_PUBLISH=false the CMS's content edits live only on disk; `git pull`
+# would clobber them, so this refuses to pull when content/ is dirty. Enable
+# GIT_PUBLISH=true (cms/.env) for a clean, git-backed update path.
+set -euo pipefail
+cd /opt/kgva-src
+if [ -n "$(git status --porcelain -- content 2>/dev/null)" ]; then
+  echo "WARN: uncommitted content edits in content/ — NOT pulling (would clobber)."
+  echo "      Enable GIT_PUBLISH or commit/stash first; rebuilding current core only."
+else
+  git fetch -q origin main && git reset -q --hard origin/main
+fi
+chown -R 1000:1000 /opt/kgva-src
+docker build -t kgva-cms --build-arg HUGO_VERSION=0.163.3 -f cms/core/api/Dockerfile cms/core
+docker rm -f kgva-cms 2>/dev/null || true
+docker run -d --name kgva-cms --restart unless-stopped \
+  -e CMS_CONFIG=/site/cms/kgva.config.js -e SITE_DIR=/site -e USERS_FILE=/site/cms/users.json -e PORT=3000 \
+  --env-file /opt/kgva-src/cms/.env -v /opt/kgva-src:/site -p 127.0.0.1:8081:3000 kgva-cms
+sleep 2
+echo "updated → core $(docker exec kgva-cms sh -c 'grep -o \"\\\"version\\\": \\\"[^\\\"]*\\\"\" /app/package.json')"