diff --git a/src/pages/get-started/install/windows.mdx b/src/pages/get-started/install/windows.mdx
index c974addd1..82d0deb98 100644
--- a/src/pages/get-started/install/windows.mdx
+++ b/src/pages/get-started/install/windows.mdx
@@ -18,6 +18,10 @@ The NetBird client (agent) allows a peer to join a pre-existing NetBird deployme
 
 Both installers support silent (unattended) installation for use with RMM tools, MDM platforms, and scripted deployments.
 
+<Note>
+    Silent installation writes to `C:\Program Files` and registers a Windows service, so it requires an elevated administrator or `SYSTEM` context. Make sure the deployment job runs elevated: tools such as PDQ, Intune, and Group Policy typically install as `SYSTEM` when targeting computers, but a job configured to run in the user's context is not elevated and fails with exit code `1625` (`This installation is forbidden by system policy`). A standard user running the installer interactively is prompted for elevation instead.
+</Note>
+
 ### EXE Installer (NSIS)
 
 Run the EXE installer with the `/S` flag for a silent installation:
@@ -62,6 +66,26 @@ netbird up --setup-key <SETUP KEY>
     For MDM-specific deployment guides, see [Deploy with Intune](/manage/peers/mdm-deployment/intune-netbird-integration) or [Deploy with Acronis](/manage/for-partners/acronis-integration).
 </Note>
 
+### Updating an Existing Installation
+
+There is no separate update package. The same installer upgrades an existing installation in place: run the newer version and it replaces the installed one, keeping the peer's registration and configuration. Push the newer MSI (or EXE) through a deployment job that runs the installer even when NetBird is already present. Some install jobs deliberately skip deployment once they detect an existing installation, so a job like that will not upgrade. The script in the [Group Policy deployment guide](/manage/peers/mdm-deployment/windows-gpo-deployment), for example, exits early if NetBird is already installed, so use an upgrade-capable job for updates.
+
+```bash
+msiexec /i netbird_installer_<NEW_VERSION>_windows_amd64.msi /quiet
+```
+
+Or with the EXE installer:
+
+```bash
+netbird_installer_<NEW_VERSION>_windows_amd64.exe /S
+```
+
+Like the initial install, an upgrade requires an elevated context, so the upgrade job must run as administrator or `SYSTEM`. Downgrades are blocked: installing a version older than the one already present exits with an error (`1603`) and leaves the current installation untouched.
+
+<Note>
+    Alternatively, you can let end users update from the client itself with [Automatic Updates](/manage/peers/auto-update), where the NetBird service performs the install with no administrator rights required from the user.
+</Note>
+
 ## Running NetBird with SSO Login
 ### Desktop UI Application
 Launch the desktop app and click **Connect** in the main window or system-tray menu. On first launch, choose NetBird Cloud or enter the URL of your self-hosted deployment. NetBird opens your browser to authenticate the device. See the [desktop app guide](/client/desktop-app) for the complete interface.
diff --git a/src/pages/manage/peers/auto-update.mdx b/src/pages/manage/peers/auto-update.mdx
index bb006b429..cb7c1538d 100644
--- a/src/pages/manage/peers/auto-update.mdx
+++ b/src/pages/manage/peers/auto-update.mdx
@@ -48,10 +48,14 @@ When you need updates to be installed without user interaction, enable the **For
 3. **Update Process**:
     1. If the Peer is running an older version than specified, it will prompt the user to install the update via a system notification and an install entry in the NetBird tray menu.
     2. Client will then download the update package from the official NetBird repository.
-    3. The Peer will then install the update and restart itself to apply the changes.
+    3. The NetBird background service, which runs with system privileges, installs the update and restarts the client to apply it.
 
 When **Force Automatic Updates** is enabled, step 3.1 is skipped, the update is installed automatically in the background without user interaction.
 
+<Note>
+    Accepting a prompted update does **not** require the user to have administrator rights. The installation in step 3.3 is performed by the NetBird background service, which already runs with system privileges, not by the logged-in user. This is the same install mechanism as a forced update; the only difference is who triggers it. Manually running the installer instead (for example, from the tray's download link when Automatic Updates is off) is a per-machine install and does require elevation.
+</Note>
+
 ## Supported Platforms
 
 Automatic Updates are supported on the following platforms only: