diff --git a/app/Console/Commands/UpdateCommand.php b/app/Console/Commands/UpdateCommand.php
index 13e897a7..bbe0e6e7 100644
--- a/app/Console/Commands/UpdateCommand.php
+++ b/app/Console/Commands/UpdateCommand.php
@@ -46,6 +46,12 @@ class UpdateCommand extends Command
     {
         set_time_limit(3600); // 1 hour
 
+        if (config('invoiceshelf.containerized')) {
+            $this->error('The in-app updater is disabled in containerized installs. Upgrade with `docker compose pull`.');
+
+            return;
+        }
+
         $this->installed = $this->getInstalledVersion();
         $this->response = $this->getLatestVersionResponse();
         $this->version = ($this->response) ? $this->response->version : false;
diff --git a/app/Http/Controllers/AppVersionController.php b/app/Http/Controllers/AppVersionController.php
index 66b60a24..02e4d511 100644
--- a/app/Http/Controllers/AppVersionController.php
+++ b/app/Http/Controllers/AppVersionController.php
@@ -27,6 +27,7 @@ class AppVersionController extends Controller
         return response()->json([
             'version' => $version,
             'channel' => $channel,
+            'containerized' => (bool) config('invoiceshelf.containerized'),
         ]);
     }
 }
diff --git a/app/Http/Middleware/EnsureNotContainerized.php b/app/Http/Middleware/EnsureNotContainerized.php
new file mode 100644
index 00000000..c3fe2260
--- /dev/null
+++ b/app/Http/Middleware/EnsureNotContainerized.php
@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Blocks the in-app updater when running inside the official Docker image.
+ *
+ * Containers are upgraded with `docker compose pull`, not by copying release
+ * files over the image filesystem (which is ephemeral and reset on recreate).
+ * The CONTAINERIZED flag is injected into .env by docker/production/inject.sh.
+ */
+class EnsureNotContainerized
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        abort_if(
+            (bool) config('invoiceshelf.containerized'),
+            403,
+            'The in-app updater is disabled in containerized installs. Upgrade with `docker compose pull`.'
+        );
+
+        return $next($request);
+    }
+}
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 84b0e881..26f4d8e1 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -8,6 +8,7 @@ use App\Http\Middleware\CustomerGuest;
 use App\Http\Middleware\CustomerPortalMiddleware;
 use App\Http\Middleware\CustomerRedirectIfAuthenticated;
 use App\Http\Middleware\EncryptCookies;
+use App\Http\Middleware\EnsureNotContainerized;
 use App\Http\Middleware\InstallationMiddleware;
 use App\Http\Middleware\PdfMiddleware;
 use App\Http\Middleware\PreventRequestForgery;
@@ -82,6 +83,7 @@ return Application::configure(basePath: dirname(__DIR__))
             'customer-portal' => CustomerPortalMiddleware::class,
             'guest' => RedirectIfAuthenticated::class,
             'install' => InstallationMiddleware::class,
+            'not-containerized' => EnsureNotContainerized::class,
             'pdf-auth' => PdfMiddleware::class,
             'redirect-if-installed' => RedirectIfInstalled::class,
             'redirect-if-unauthenticated' => RedirectIfUnauthorized::class,
diff --git a/config/invoiceshelf.php b/config/invoiceshelf.php
index 944c06d4..7ec9fcdc 100644
--- a/config/invoiceshelf.php
+++ b/config/invoiceshelf.php
@@ -53,6 +53,15 @@ return [
     */
     'base_url' => env('INVOICESHELF_BASE_URL', 'https://invoiceshelf.com'),
 
+    /*
+    * Whether the app runs inside the official Docker image. The image's
+    * docker/production/inject.sh sets CONTAINERIZED=true in .env at startup.
+    * When true, the in-app updater is disabled (the API refuses and the UI hides
+    * it) because containers upgrade via `docker compose pull`, not by copying
+    * release files over the read-only/ephemeral image filesystem.
+    */
+    'containerized' => env('CONTAINERIZED', false),
+
     /*
     * Paths protected from cleanup during updates.
     * The updater will never delete files under these prefixes.
diff --git a/lang/en.json b/lang/en.json
index b051ad13..bc858e39 100644
--- a/lang/en.json
+++ b/lang/en.json
@@ -26,6 +26,7 @@
     "copy_pdf_url": "Copy PDF Url",
     "download_pdf": "Download PDF",
     "save": "Save",
+    "skip": "Skip",
     "create": "Create",
     "cancel": "Cancel",
     "accept": "Accept",
@@ -1483,7 +1484,9 @@
       "update_failed": "Update Failed",
       "update_failed_text": "Sorry! Your update failed on : {step} step",
       "update_warning": "All of the application files and default template files will be overwritten when you update the application using this utility. Please take a backup of your templates & database before updating.",
-      "requirements_not_met": "Update cannot continue because some system requirements are not met (including minimum PHP version). Please fix the failed requirements and try again."
+      "requirements_not_met": "Update cannot continue because some system requirements are not met (including minimum PHP version). Please fix the failed requirements and try again.",
+      "containerized_title": "Running in Docker",
+      "containerized_message": "The in-app updater is disabled for Docker installs. To upgrade, pull the latest image and recreate the container:"
     },
     "backup": {
       "title": "Backups | Backups",
diff --git a/resources/scripts/api/services/setting.service.ts b/resources/scripts/api/services/setting.service.ts
index f193aa25..85283a33 100644
--- a/resources/scripts/api/services/setting.service.ts
+++ b/resources/scripts/api/services/setting.service.ts
@@ -102,7 +102,11 @@ export const settingService = {
   },
 
   // App Version
-  async getAppVersion(): Promise<{ version: string; channel: string }> {
+  async getAppVersion(): Promise<{
+    version: string
+    channel: string
+    containerized: boolean
+  }> {
     const { data } = await client.get(API.APP_VERSION)
     return data
   },
diff --git a/resources/scripts/features/admin/views/settings/AdminUpdateAppView.vue b/resources/scripts/features/admin/views/settings/AdminUpdateAppView.vue
index fad95c9d..a3f3da8f 100644
--- a/resources/scripts/features/admin/views/settings/AdminUpdateAppView.vue
+++ b/resources/scripts/features/admin/views/settings/AdminUpdateAppView.vue
@@ -34,6 +34,7 @@ const { t } = useI18n()
 const isCheckingForUpdate = ref(false)
 const isUpdating = ref(false)
 const insiderChannel = ref(false)
+const isContainerized = ref(false)
 const currentVersion = ref('')
 const updateRelease = ref<UpdateRelease | null>(null)
 const isMinorUpdate = ref(false)
@@ -103,6 +104,7 @@ async function loadCurrentVersion(): Promise<void> {
     const response = await settingService.getAppVersion()
     currentVersion.value = response.version
     insiderChannel.value = response.channel === 'insider'
+    isContainerized.value = Boolean(response.containerized)
   } catch (error: unknown) {
     showApiError(error)
   }
@@ -316,13 +318,38 @@ function showApiError(error: unknown): void {
         </div>
       </div>
 
-      <div class="pt-4">
-        <BaseCheckbox
-          v-model="insiderChannel"
-          :label="$t('settings.update_app.insider_consent')"
-        />
+      <!-- Containerized (Docker) install: the in-app updater is disabled. -->
+      <div v-if="isContainerized" class="mt-4 rounded-md bg-primary-50 p-4">
+        <div class="flex">
+          <div class="shrink-0">
+            <BaseIcon
+              name="InformationCircleIcon"
+              class="h-5 w-5 text-primary-400"
+            />
+          </div>
+          <div class="ml-3">
+            <h3 class="text-sm font-medium text-primary-800">
+              {{ $t('settings.update_app.containerized_title') }}
+            </h3>
+            <div class="mt-2 text-sm text-primary-700">
+              <p>{{ $t('settings.update_app.containerized_message') }}</p>
+              <pre
+                class="mt-3 overflow-x-auto rounded-md bg-surface-muted p-3 text-xs text-body"
+              >docker compose pull
+docker compose up --force-recreate --build -d</pre>
+            </div>
+          </div>
+        </div>
       </div>
 
+      <template v-else>
+        <div class="pt-4">
+          <BaseCheckbox
+            v-model="insiderChannel"
+            :label="$t('settings.update_app.insider_consent')"
+          />
+        </div>
+
       <BaseButton
         :loading="isCheckingForUpdate"
         :disabled="isCheckingForUpdate || isUpdating"
@@ -457,6 +484,7 @@ function showApiError(error: unknown): void {
           </li>
         </ul>
       </div>
+      </template>
     </div>
   </BaseSettingCard>
 </template>
diff --git a/routes/api.php b/routes/api.php
index dbd742ac..c4a8f02b 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -473,15 +473,19 @@ Route::prefix('/v1')->group(function () {
 
         // Self Update
         // ----------------------------------
+        // Disabled inside the official Docker image — containers upgrade via
+        // `docker compose pull`, not the in-app updater (see EnsureNotContainerized).
 
-        Route::get('/check/update', [UpdateController::class, 'checkVersion']);
-        Route::post('/update/download', [UpdateController::class, 'download']);
-        Route::post('/update/unzip', [UpdateController::class, 'unzip']);
-        Route::post('/update/copy', [UpdateController::class, 'copy']);
-        Route::post('/update/delete', [UpdateController::class, 'delete']);
-        Route::post('/update/clean', [UpdateController::class, 'clean']);
-        Route::post('/update/migrate', [UpdateController::class, 'migrate']);
-        Route::post('/update/finish', [UpdateController::class, 'finish']);
+        Route::middleware('not-containerized')->group(function () {
+            Route::get('/check/update', [UpdateController::class, 'checkVersion']);
+            Route::post('/update/download', [UpdateController::class, 'download']);
+            Route::post('/update/unzip', [UpdateController::class, 'unzip']);
+            Route::post('/update/copy', [UpdateController::class, 'copy']);
+            Route::post('/update/delete', [UpdateController::class, 'delete']);
+            Route::post('/update/clean', [UpdateController::class, 'clean']);
+            Route::post('/update/migrate', [UpdateController::class, 'migrate']);
+            Route::post('/update/finish', [UpdateController::class, 'finish']);
+        });
 
         // Companies
         // -------------------------------------------------
diff --git a/tests/Feature/Admin/UpdateContainerizedTest.php b/tests/Feature/Admin/UpdateContainerizedTest.php
new file mode 100644
index 00000000..864bf25b
--- /dev/null
+++ b/tests/Feature/Admin/UpdateContainerizedTest.php
@@ -0,0 +1,46 @@
+<?php
+
+use App\Models\User;
+use Laravel\Sanctum\Sanctum;
+
+use function Pest\Laravel\getJson;
+use function Pest\Laravel\postJson;
+
+beforeEach(function () {
+    Artisan::call('db:seed', ['--class' => 'DatabaseSeeder', '--force' => true]);
+    Artisan::call('db:seed', ['--class' => 'DemoSeeder', '--force' => true]);
+
+    $user = User::where('role', 'super admin')->first();
+
+    $this->withHeaders([
+        'company' => $user->companies()->first()->id,
+    ]);
+
+    Sanctum::actingAs($user, ['*']);
+});
+
+it('exposes the containerized flag from the app version endpoint', function () {
+    config(['invoiceshelf.containerized' => true]);
+
+    getJson('/api/v1/app/version')
+        ->assertOk()
+        ->assertJson(['containerized' => true]);
+
+    config(['invoiceshelf.containerized' => false]);
+
+    getJson('/api/v1/app/version')
+        ->assertOk()
+        ->assertJson(['containerized' => false]);
+});
+
+it('blocks the in-app updater endpoints when containerized', function () {
+    config(['invoiceshelf.containerized' => true]);
+
+    getJson('/api/v1/check/update')->assertForbidden();
+    postJson('/api/v1/update/download', ['version' => '2.4.0'])->assertForbidden();
+    postJson('/api/v1/update/unzip', ['path' => '/tmp/x.zip'])->assertForbidden();
+    postJson('/api/v1/update/copy', ['path' => '/tmp/x'])->assertForbidden();
+    postJson('/api/v1/update/clean')->assertForbidden();
+    postJson('/api/v1/update/migrate')->assertForbidden();
+    postJson('/api/v1/update/finish', ['installed' => '2.4.0', 'version' => '2.4.1'])->assertForbidden();
+});