diff --git a/runpodctl/overview.mdx b/runpodctl/overview.mdx
index 3db0f7b7..a7bb931f 100644
--- a/runpodctl/overview.mdx
+++ b/runpodctl/overview.mdx
@@ -45,6 +45,10 @@ bash <(curl -sL cli.runpod.io)
 
 The script installs the latest version to `/usr/local/bin` when run as root, or to `~/.local/bin` for non-root users. If you don't have root access, the script displays instructions for adding `runpodctl` to your PATH.
 
+<Note>
+The install script verifies the downloaded release against its SHA-256 checksum before installing, so it needs a checksum tool to be present: `sha256sum` on Linux or `shasum` on macOS. These are preinstalled in most environments, but on minimal images without one the install aborts.
+</Note>
+
 </Tab>
 
 <Tab title="macOS">
diff --git a/runpodctl/reference/runpodctl-update.mdx b/runpodctl/reference/runpodctl-update.mdx
index 9517bca0..a7f94669 100644
--- a/runpodctl/reference/runpodctl-update.mdx
+++ b/runpodctl/reference/runpodctl-update.mdx
@@ -13,7 +13,7 @@ runpodctl update
 
 ## Description
 
-The `update` command downloads and installs the latest version of `runpodctl`. After updating, verify the installation with [`runpodctl version`](/runpodctl/reference/runpodctl-version).
+The `update` command downloads the latest version of `runpodctl` and verifies it against its SHA-256 checksum before replacing the installed binary. Verification always runs. If it fails, the update aborts and leaves your existing binary in place. After updating, verify the installation with [`runpodctl version`](/runpodctl/reference/runpodctl-version).
 
 ## Related commands