diff --git a/AGENTS.md b/AGENTS.md
index 8045d82..30b0a96 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -8,11 +8,11 @@
 
 ## Agent installation
 
-- Agent configuration installation lives in `install-agents.sh` (extracted from `install.sh`).
-- `install.sh` sources `install-agents.sh` at the end to keep bootstrap flow readable.
-- `install-agents.sh` checks SSH access to `DOLAN_AGENTS_REPO_SSH` (default: `git@github.com:MatthewDolan/agents.git`) before cloning or running anything.
+- Agent configuration installation lives in `agents/install.sh` (extracted from `install.sh`).
+- `install.sh` sources `agents/install.sh` at the end to keep bootstrap flow readable.
+- `agents/install.sh` checks SSH access to `DOLAN_AGENTS_REPO_SSH` (default: `git@github.com:MatthewDolan/agents.git`) before cloning or running anything.
 
 ## Existing `~/.agents` validation
 
-- If `~/.agents` already exists, `install-agents.sh` validates it is a git repo and that one of its remotes exactly matches `DOLAN_AGENTS_REPO_SSH`.
+- If `~/.agents` already exists, `agents/install.sh` validates it is a git repo and that one of its remotes exactly matches `DOLAN_AGENTS_REPO_SSH`.
 - If `~/.agents` exists but is not the expected repo, installation exits with an error and prints existing remotes for diagnostics.
diff --git a/install-agents.sh b/agents/install.sh
similarity index 82%
rename from install-agents.sh
rename to agents/install.sh
index 40dcb3f..48482f5 100755
--- a/install-agents.sh
+++ b/agents/install.sh
@@ -5,6 +5,7 @@ install_agents_configuration() {
   # Keep variables local so this helper can be safely sourced by install.sh.
   local agents_repo
   local agents_target
+  local current_sha
   local matching_remote
   local remote_name
   local remote_url
@@ -14,13 +15,6 @@ install_agents_configuration() {
   agents_repo="${DOLAN_AGENTS_REPO_SSH:-git@github.com:MatthewDolan/agents.git}"
   agents_target="${HOME}/.agents"
 
-  # If the current SSH identity cannot read the repo, skip gracefully.
-  echo "Checking SSH access to ${agents_repo}..."
-  if ! git ls-remote --exit-code "${agents_repo}" >/dev/null 2>&1; then
-    echo "No SSH access to ${agents_repo}; cannot install agent configuration."
-    return 0
-  fi
-
   # Reuse existing checkout when present, but only after validating identity.
   if [[ -e "${agents_target}" ]]; then
     if [[ ! -d "${agents_target}" ]]; then
@@ -60,9 +54,17 @@ install_agents_configuration() {
       return 1
     fi
 
-    echo "Using existing agents repository at ${agents_target} (matched remote: ${matching_remote})..."
+    current_sha="$(git -C "${agents_target}" rev-parse --short HEAD 2>/dev/null || echo "unknown")"
+    echo "Using existing agents repository at ${agents_target} (matched remote: ${matching_remote}, sha: ${current_sha}; no fetch/pull)..."
   else
-    # No existing checkout, so clone the repo now that access is confirmed.
+    # No existing checkout. Confirm SSH access before cloning.
+    echo "Checking SSH access to ${agents_repo}..."
+    if ! git ls-remote --exit-code "${agents_repo}" >/dev/null 2>&1; then
+      echo "No SSH access to ${agents_repo}; cannot install agent configuration."
+      return 0
+    fi
+
+    # Clone after access has been confirmed.
     echo "Cloning agents repository to ${agents_target}..."
     git clone "${agents_repo}" "${agents_target}"
   fi
diff --git a/home/.zshrc b/home/.zshrc
index 8a9cf78..c8aada1 100644
--- a/home/.zshrc
+++ b/home/.zshrc
@@ -126,6 +126,26 @@ _dotfiles_check_for_upgrade() {
 }
 _dotfiles_check_for_upgrade
 
+# Check for agents upgrades (once every 24 hours)
+_agents_check_for_upgrade() {
+  local stamp_file="${HOME}/.agents-last-update-check"
+  local now
+  now="$(date +%s)"
+  local last_check=0
+
+  if [[ -f "${stamp_file}" ]]; then
+    last_check="$(cat "${stamp_file}")"
+  fi
+
+  if (( now - last_check >= 86400 )); then
+    echo "${now}" > "${stamp_file}"
+    if command -v agents-check-for-upgrade.sh >/dev/null 2>&1; then
+      agents-check-for-upgrade.sh
+    fi
+  fi
+}
+_agents_check_for_upgrade
+
 # Source ~/.zshrc.local (not checked into the repo)
 # This is where you would put local configuration that's only for this computer.
 # For example, sourcing company specific files or setting secret keys as
diff --git a/home/bin/agents-check-for-upgrade.sh b/home/bin/agents-check-for-upgrade.sh
new file mode 100755
index 0000000..d14243e
--- /dev/null
+++ b/home/bin/agents-check-for-upgrade.sh
@@ -0,0 +1,39 @@
+#!/bin/zsh
+set -euo pipefail
+
+agents_dir="${HOME}/.agents"
+
+# Skip silently when agents repo is not installed.
+if [[ ! -d "${agents_dir}" ]]; then
+  exit 0
+fi
+
+# Verify it's a git repository.
+if ! git -C "${agents_dir}" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  echo "Error: ${agents_dir} is not a git repository." >&2
+  exit 1
+fi
+
+# Fetch latest from remote; exit silently on network failure.
+if ! git -C "${agents_dir}" fetch --quiet 2>/dev/null; then
+  exit 0
+fi
+
+# Compare local HEAD to upstream.
+local_head="$(git -C "${agents_dir}" rev-parse HEAD)"
+remote_head="$(git -C "${agents_dir}" rev-parse '@{u}' 2>/dev/null)" || exit 0
+
+if [[ "${local_head}" == "${remote_head}" ]]; then
+  exit 0
+fi
+
+# Show what's new.
+echo "Agents updates available:"
+git -C "${agents_dir}" log --oneline HEAD.."@{u}"
+echo ""
+
+# Prompt for upgrade.
+read -r -p "Upgrade agents? [y/N] " response
+if [[ "${response}" =~ ^[Yy]$ ]]; then
+  agents-upgrade.sh
+fi
diff --git a/home/bin/agents-upgrade.sh b/home/bin/agents-upgrade.sh
new file mode 100755
index 0000000..010581d
--- /dev/null
+++ b/home/bin/agents-upgrade.sh
@@ -0,0 +1,15 @@
+#!/bin/zsh
+set -euo pipefail
+
+agents_dir="${HOME}/.agents"
+
+# Verify it's a git repository.
+if ! git -C "${agents_dir}" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  echo "Error: ${agents_dir} is not a git repository." >&2
+  exit 1
+fi
+
+echo "Upgrading agents from ${agents_dir}..."
+git -C "${agents_dir}" pull --ff-only
+"${agents_dir}/install.sh"
+echo "Agents upgraded successfully."
diff --git a/install.sh b/install.sh
index 9977510..e2f98f2 100755
--- a/install.sh
+++ b/install.sh
@@ -76,4 +76,4 @@ if [[ "${os_name}" == "Darwin" ]]; then
 fi
 
 # Keep agents bootstrap logic in a dedicated script for readability.
-. "${script_dir}/install-agents.sh"
+. "${script_dir}/agents/install.sh"