@@ -738,10 +738,19 @@ jobs:
         # It is variant-independent, so one copy serves every image.
         run: |
           set -euo pipefail
-          src=src/modules/bgrpiimage-base/filesystem/root/usr/local/sbin/bgrpiimage-setup
-          install -m 0755 "$src" release-assets/bgrpiimage-setup
-          ( cd release-assets && sha256sum bgrpiimage-setup > bgrpiimage-setup.sha256 )
-          sha256sum release-assets/bgrpiimage-setup
+          base=src/modules/bgrpiimage-base/filesystem/root
+          install -m 0755 "$base/usr/local/sbin/bgrpiimage-setup"  release-assets/bgrpiimage-setup
+          install -m 0755 "$base/usr/local/sbin/bgrpiimage-update" release-assets/bgrpiimage-update
+          # The trust keys too. They are public by definition, and publishing
+          # them beside the bundle means a device from before signing can be
+          # bootstrapped from the same release URL as everything else, instead
+          # of needing a raw.githubusercontent path nobody can verify at a
+          # glance.
+          install -m 0644 "$base"/usr/share/bgrpiimage/trusted-keys.d/*.pub release-assets/
+          ( cd release-assets \
+            && sha256sum bgrpiimage-setup  > bgrpiimage-setup.sha256 \
+            && sha256sum bgrpiimage-update > bgrpiimage-update.sha256 )
+          sha256sum release-assets/bgrpiimage-setup release-assets/bgrpiimage-update
 
       # The GitHub release itself is created by release.yml (semantic-release)
       # when the version is bumped on main. Here we only *append* the image
@@ -757,7 +766,9 @@ jobs:
             release-assets/*.manifest.json
             release-assets/*.confbundle.tar.gz
             release-assets/*.bundle.manifest.json.sig
+            release-assets/*.pub
             release-assets/bgrpiimage-setup
+            release-assets/bgrpiimage-update
           fail_on_unmatched_files: true
           append_body: true
           body: |
 
@@ -488,8 +488,56 @@ dependency of `ca-certificates` — a signature format needing a package the
 device cannot install without an update would be circular.
 
 > **Images from before signing carry no trust directory** and will refuse every
-> bundle, saying so explicitly. Those devices need one reflash to a signed
-> image; after that they update in place like the rest.
+> bundle, saying so explicitly. They can be brought up by hand once — see
+> below — or reflashed.
+
+### Bootstrapping a device from before in-place updates
+
+A unit flashed before this mechanism existed is missing four things: the
+updater itself, the trust directory, a current helper, and the identity fields
+the safety checks read. All four can be installed once, over SSH, without
+reflashing. Everything fetched here is a published release asset.
+
+```bash
+R=https://github.com/bauer-group/XPD-RPIImage/releases/latest/download
+
+sudo curl -fsSL --proto '=https' -o /usr/local/sbin/bgrpiimage-update "$R/bgrpiimage-update"
+sudo curl -fsSL --proto '=https' -o /usr/local/sbin/bgrpiimage-setup  "$R/bgrpiimage-setup"
+sudo chmod 0755 /usr/local/sbin/bgrpiimage-update /usr/local/sbin/bgrpiimage-setup
+
+sudo install -d /usr/share/bgrpiimage/trusted-keys.d
+sudo curl -fsSL --proto '=https' \
+     -o /usr/share/bgrpiimage/trusted-keys.d/bgrpiimage-recovery.pub \
+     "$R/bgrpiimage-recovery.pub"
+```
+
+Then record what the image was built from, which the old release file does not
+say:
+
+```bash
+sudo tee -a /etc/bgrpiimage-release >/dev/null <<'EOF'
+BGRPIIMAGE_BASE_IMAGE_SHA256='acff736ca7945e3b305f07cda4abdb870910e12634991da69783611756e381b3'
+BGRPIIMAGE_APPLY_CONTRACT=1
+EOF
+
+sudo bgrpiimage-update plan     # look before you leap
+sudo bgrpiimage-update apply
+```
+
+**Why that hash is safe to write.** It is the base image every release since
+**v0.5.0** has been built on — the switch to Raspberry Pi OS Lite — and it has
+not changed since. Check the first line of `sudo bgrpiimage-setup status`: if
+the device reports **v0.5.0 or newer**, it is provably on that base and the
+value above is correct for it.
+
+> ⚠️ **A device older than v0.5.0 is on a different base OS.** Do not write
+> that hash there. Reflash instead — the whole point of the check is that
+> configuration built for one base must not be applied on top of another.
+
+Nothing here is a special code path: after the four files are in place the
+device is indistinguishable from one flashed with a current image, and every
+refusal and verification described above applies to it unchanged. The procedure
+is exercised end to end in `tests/test-update.sh`.
 
 ### What it never touches
 
 
@@ -91,6 +91,12 @@ cp /repo/dist/*.bundle.manifest.json "$DL/" 2>/dev/null || \
     tar xzOf "$BUNDLE" manifest.json > "$DL/bgrpiimage-${VARIANT}-v${VERSION}.bundle.manifest.json"
 ( cd "$DL" && sha256sum "$(basename "$BUNDLE")" > "$(basename "$BUNDLE").sha256" )
 
+# Helpers and trust keys, exactly as the release job publishes them.
+B=/repo/src/modules/bgrpiimage-base/filesystem/root
+install -m 0755 "$B/usr/local/sbin/bgrpiimage-setup"  "$DL/bgrpiimage-setup"
+install -m 0755 "$B/usr/local/sbin/bgrpiimage-update" "$DL/bgrpiimage-update"
+install -m 0644 "$B"/usr/share/bgrpiimage/trusted-keys.d/*.pub "$DL/"
+
 cd "$WEB" || exit 1
 python3 -c "
 import http.server, ssl, socketserver, os
@@ -318,6 +324,55 @@ grep -qi "no trusted keys" /tmp/sg5 \
     && ok "a device with no trust store refuses and explains" \
     || { bad "device without trust store did not refuse clearly"; tail -4 /tmp/sg5; }
 
+sect "11. bootstrapping hardware from before in-place updates"
+# What a device flashed at, say, v0.7.7 actually looks like: no updater, no
+# trust store, and a release file with none of the identity the checks need.
+# The documented procedure has to take it from there to a working update, or
+# an existing fleet can never join without a reflash.
+seed_device 0.0.1
+rm -rf /usr/share/bgrpiimage/trusted-keys.d /usr/local/sbin/bgrpiimage-update
+cat > /etc/bgrpiimage-release <<EOF
+BGRPIIMAGE_DIST="bgrpiimage"
+BGRPIIMAGE_VARIANT='$VARIANT'
+BGRPIIMAGE_VERSION='0.7.7'
+EOF
+
+# It must refuse before the bootstrap - otherwise this proves nothing.
+if [ -x /usr/local/sbin/bgrpiimage-update ]; then
+    bad "fixture is wrong: the updater is still installed"
+else
+    ok "a pre-update device has no updater at all"
+fi
+
+# --- the documented procedure, run verbatim --------------------------------
+R="$BGRPIIMAGE_UPDATE_DL/$REPO/releases/download/v$VERSION"
+curl -fsSL --proto '=https' -o /usr/local/sbin/bgrpiimage-update "$R/bgrpiimage-update"
+chmod 0755 /usr/local/sbin/bgrpiimage-update
+curl -fsSL --proto '=https' -o /usr/local/sbin/bgrpiimage-setup  "$R/bgrpiimage-setup"
+chmod 0755 /usr/local/sbin/bgrpiimage-setup
+install -d /usr/share/bgrpiimage/trusted-keys.d
+curl -fsSL --proto '=https' \
+     -o /usr/share/bgrpiimage/trusted-keys.d/bgrpiimage-recovery.pub \
+     "$R/bgrpiimage-recovery.pub"
+# base_image.sha256 has been the same since v0.5.0, so any device from that
+# release onwards is provably on this base - see the note in the docs.
+{
+  echo "BGRPIIMAGE_BASE_IMAGE_SHA256='$BASE_SHA'"
+  echo "BGRPIIMAGE_APPLY_CONTRACT=1"
+} >> /etc/bgrpiimage-release
+
+$U apply --yes >/tmp/bs 2>&1; rc=$?
+[ $rc -eq 0 ] && ok "bootstrapped device applies the update" \
+              || { bad "apply failed after bootstrap"; tail -12 /tmp/bs; }
+grep -qi "signature verified" /tmp/bs \
+    && ok "and verifies the signature against the fetched key" \
+    || bad "signature was not verified after bootstrap"
+grep -q "BGRPIIMAGE_CONFIG_VERSION='$VERSION'" /etc/bgrpiimage-applied \
+    && ok "configuration version recorded" || bad "version not recorded"
+grep -q "BGRPIIMAGE_VERSION='0.7.7'" /etc/bgrpiimage-release \
+    && ok "still reports the originally flashed image" \
+    || bad "the flashed version was overwritten"
+
 echo
 echo "================ $PASS passed, $FAIL failed ================"
 [ "$FAIL" -eq 0 ]