diff --git a/server/README.md b/server/README.md
index 46120dc..e8d2bbf 100644
--- a/server/README.md
+++ b/server/README.md
@@ -11,6 +11,17 @@ Self-hosted [Supabase](https://supabase.com/docs/guides/self-hosting/docker) in
 | Studio | Admin dashboard in the browser (password protected) |
 | Caddy | HTTPS with automatic Let's Encrypt certificates |
 
+## Updating the live server
+
+The code lives at https://git.metatroncube.in/MetatroncubeSoftwareSolutions/nkbmusic and the server runs from a clone of it in `~/APPS/nanga_kathai`. After pushing changes:
+
+```sh
+ssh dev@72.62.169.43
+sh ~/APPS/nanga_kathai/server/update.sh
+```
+
+That pulls the latest code, applies new migrations and config, and restarts what changed. Passwords, keys and songs are kept.
+
 ## Quick deploy (one command)
 
 On a fresh Ubuntu server, once the DNS A record for `app.nkbmusic.com` points at it:
diff --git a/server/update.sh b/server/update.sh
new file mode 100644
index 0000000..af037c4
--- /dev/null
+++ b/server/update.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+# Pull the latest code from git and redeploy the backend (new migrations,
+# config, email templates). Secrets and data are kept.
+#
+#   sh ~/APPS/nanga_kathai/server/update.sh
+#
+# Settings below match the HestiaCP server; override with env vars if needed.
+set -eu
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+DOMAIN="${NK_DOMAIN:-app.nkbmusic.com}"
+export NK_DIR="${NK_DIR:-$HOME/APPS/nk-backend}"
+
+echo "==> Pulling the latest code"
+git -C "$HERE/.." pull --ff-only
+git -C "$HERE/.." log --oneline -1
+
+sh "$HERE/deploy.sh" "$DOMAIN" </dev/null