> ## Documentation Index > Fetch the complete documentation index at: https://docs.devin.ai/llms.txt > Use this file to discover all available pages before exploring further. # Update Air-Gapped Devin Desktop and CLI > How new air-gapped Devin Desktop and CLI versions appear on the portal downloads page, and how to verify, install, and validate an update without auto-update. > [!NOTE] > > This documentation is for the federal deployments of Devin. [Back to Devin Docs](/get-started/devin-intro) The air-gapped Desktop and CLI never update themselves: auto-update is disabled in the Desktop build and `devin update` is disabled in the CLI. Every update is a new bundle that you download from the portal, verify, and install on each workstation, following the same process as the first [install](/federal/air-gapped/install). This page covers what is different the second time around. *** ## How a new version appears The portal's **Install → Air-gapped downloads** page ([`windsurf.fedstart.com/install/airgap`](https://windsurf.fedstart.com/install/airgap)) serves exactly one release at a time. The version is shown in the **Downloads** heading (for example `version 1.66.101 (0123abcdef)`), and the SHA-256 checksum of each file is shown through the **Show checksum** control next to it. When Cognition releases a new air-gapped build to your portal, the page starts serving the new version and checksums in place of the old ones; there is no version picker and no notification. To track releases, check the version label on the downloads page as part of your regular maintenance cycle. ## Step 1: Check what you are running On a workstation, compare the installed CLI version with the version shown on the downloads page: ```sh theme={null} devin --version ``` ```text theme={null} devin-federal +airgap. ``` `devin --version` prints the release version and the short commit of the build. Desktop and its bundled CLI are built from the same commit, so this version applies to both. ## Step 2: Download and verify the new bundle Follow [Step 1](/federal/air-gapped/install#step-1-download-the-bundle-from-the-portal) and [Step 2](/federal/air-gapped/install#step-2-verify-the-checksum) of the install guide for the new version: download the package for each platform in your fleet, record the checksum from the portal page, transfer the files across the air gap, and confirm the SHA-256 matches before installing. Checksums change with every release. Record the new value from the portal page when you download; do not reuse a checksum from a previous version. ## Step 3: Install over the existing version Quit Desktop and stop any running `devin` sessions on the workstation first. Configuration, session history, the audit log, and SSO logins are stored outside the application (see [On-disk formats](/federal/air-gapped/on-disk-formats)) and are preserved across the update. **macOS** Open the new `.dmg` and drag **Devin - Airgap** into `/Applications`, replacing the existing application when prompted. Then verify the signature as in [Step 3 of the install guide](/federal/air-gapped/install#step-3-install): ```sh theme={null} spctl --assess --type execute --verbose "/Applications/Devin - Airgap.app" ``` ```text theme={null} /Applications/Devin - Airgap.app: accepted source=Notarized Developer ID ``` **Linux (.deb / .rpm)** ```sh theme={null} sudo dpkg -i Devin-linux-x64-.deb # Debian/Ubuntu sudo rpm -U Devin-linux-x64-.rpm # RHEL/Fedora ``` `dpkg -i` upgrades an installed package in place; use `rpm -U` (not `rpm -i`) so `rpm` replaces the installed version instead of refusing the install. There is no apt or yum repository for air-gapped builds. **Linux (.tar.gz)** Move the old extraction aside, then extract the new archive to the same location so the launcher path (`/opt/Devin-linux-x64/bin/devin-airgap`) and any `PATH` entry for the bundled `devin` binary stay valid: ```sh theme={null} sudo mv /opt/Devin-linux-x64 /opt/Devin-linux-x64.previous sudo tar -xzf Devin-linux-x64-.tar.gz -C /opt ``` Remove `/opt/Devin-linux-x64.previous` once the new version is validated. **Windows (installer)** Verify the Authenticode signature of the new installer as in [Step 3 of the install guide](/federal/air-gapped/install#step-3-install), then run it as an administrator: ```powershell theme={null} Get-AuthenticodeSignature .\DevinSetup-x64-.exe | Format-List Status, SignerCertificate ``` The air-gapped build has no update URL; a new installer is the only upgrade path for an installed copy. **Windows (.zip)** Unpack `Devin-win32-x64-.zip` to its own folder, verify the signature of the unpacked executables as in [Step 3 of the install guide](/federal/air-gapped/install#step-3-install), and run Desktop from the new folder. Remove the previous folder once the new version is validated, and update any `PATH` entry for the bundled `devin.exe`. The license file, models file, and auth file under `/etc/devin/` (`C:\ProgramData\Devin\` on Windows) are not part of the package and are not touched by an update. ## Step 4: Validate the update On each updated workstation, run as a normal user: ```sh theme={null} devin --version devin airgap doctor ``` ```text theme={null} devin-federal +airgap. pass license seat alice@example.gov (account acme), expires 2027-03-01 ... 10 check(s): 10 passed, 0 warning(s), 0 failure(s) ``` Then launch Desktop once and confirm it opens a session against your model endpoint. Two update-specific failures to watch for: | Symptom | Cause | Action | | - | - | - | | `LIC004` immediately after the update | The new build embeds a rotated set of public keys and your license was signed with a key the build no longer trusts. | Issue a new license from the portal and replace the file as described in [Renew or replace a license](/federal/air-gapped/license#renew-or-replace-a-license). Run the [`kid` check](/federal/air-gapped/license#check-the-key-id) to confirm. | | An `MDL` code on a models file that validated before | The new release changed models-file validation. | Run `devin models validate`; the diagnostic names the field and the code. See [Models file](/federal/air-gapped/models-file). | Every `session_start` audit record carries the `cli_version`, so your SIEM can confirm the rollout: sessions from an updated workstation report the new version. ## Rolling back Keep the previous version's package and checksum until the new version is validated across the fleet. Rolling back is the same procedure as installing: verify the checksum of the older package and install it over the newer one. On RPM systems add `--oldpackage`, because `rpm -U` otherwise refuses to replace a newer version with an older one: ```sh theme={null} sudo rpm -U --oldpackage Devin-linux-x64-.rpm ``` ## Release notes Release notes for air-gapped builds are published alongside the other Devin release notes in [Recent Updates](/release-notes/overview). Before rolling out a new version, read the entry for it and look in particular for changes to the on-disk formats or audit-log schema (the `schema_version` value), new or changed error codes, and any license key rotation that requires re-issuing licenses. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.