diff --git a/docs/UPGRADE.md b/docs/UPGRADE.md
new file mode 100644
index 0000000..78625fd
--- /dev/null
+++ b/docs/UPGRADE.md
@@ -0,0 +1,22 @@
+# Upgrade and rollback
+
+**Status:** Outline. Full POR: [design/updates-lifecycle.md](../design/updates-lifecycle.md).
+
+## Defaults
+
+- Automatic updates: **ON by default** (host timer calling `upgrade.sh`).  
+- Owner: **no** participation or chat noise.  
+- Manual: `./scripts/upgrade.sh` · dry-run · rollback.
+
+## Operator quick path (when implemented)
+
+```bash
+./scripts/upgrade.sh --dry-run
+./scripts/upgrade.sh
+./scripts/doctor.sh
+./scripts/upgrade.sh --rollback   # if needed
+```
+
+## Non-interactive Hermes
+
+Product upgrade must **not** invoke interactive `hermes update` / config wizards. Pins and sealed `nemohermes` config/inference commands only.