Upgrades and maintenance
Stage releases, check capability compatibility, manage migrations, and recover failed deployment changes.
Guard upgrades change deployment services and can separately change agent, gateway, scanner, and managed rule capabilities. Keep the release manifest and compatibility report with the change record.
Prepare and stage
At Installation → Releases, review the signed manifest, migration requirements, supported agent versions, storage requirements, and rollback boundary. Back up the recovery set and confirm its restore test before a database migration. Stage the release in an isolated environment with representative policy and evidence metadata.
For Compose, work from the new verified release directory and validate the existing guard.env against the environment inventory. Do not mix API and worker binaries from different release bundles. Pause new scans and response automation at Installation → Maintenance, allow critical in-flight actions to reconcile, and record unresolved work.
Apply and verify
Start the release using the bundle's upgrade workflow. Database migrations can make older binaries incompatible; a failed container replacement does not establish that the schema can be downgraded. Check Installation → Health, worker queues, storage access, feed sync, identity-provider sign-in, and a pilot policy's adoption.
At Endpoints → Updates and Access → Gateways → Updates, stage executor rollouts independently. Do not require a new capability in a broad policy before its targets support it. Managed WAF rule versions are a separate policy update and retain their own adoption history.
Failure and rollback
If only deployment configuration failed before a migration, restore the prior validated configuration and restart the affected service. If an incompatible migration committed, use the documented forward repair or restore a complete compatible recovery set. Replacing one image with an old tag is not sufficient.
Keep automation paused until ambiguous operations and remote state are reconciled. An agent retaining its last policy can continue protection during maintenance, but stale posture and unavailable identity services can deny new access. Inform service owners of the planned availability boundary.
Record the final release, health checks, target adoption, deferred updates, and remaining gaps in Installation → Maintenance → Complete. Never remove persistent volumes as an ordinary upgrade step.