How do updates and upgrades work when self-hosting?
- Topic
- Self-hosting
- Asked by
- Infrastructure engineers
AdminUpdated Sep 11, 2026
Self-hosted upgrades are deliberate and under your control:
Pull the new images for the API, worker and web services.
Run migrations explicitly. Deploys do not auto-migrate — this is intentional so schema changes never happen behind your back during a rolling restart.
Restart the services.
Because envelope keys are per-instance, key rotation and re-encryption are supported as maintenance operations run by the worker. Follow the release notes and the upgrade runbook in the docs for any version-specific migration steps, and watch the changelog.
You pull the new container images and run database migrations as an explicit step. Upgrades don't auto-migrate, so you stay in control of when schema changes are applied.
Was this page helpful?