@jcast An app can't update itself without the user explicitly granting the update permission. The way unattended updates work is that apps granted that permission can do unattended updates for apps where they're the current installer already or for themselves. GrapheneOS is considering eliminating the special case where apps can do an unattended update for themselves after granting the permission before they already updated themselves once but it's a very minor thing and not clear we should.