diff --git a/README.md b/README.md
index fbf9f3347..b5d621f15 100644
--- a/README.md
+++ b/README.md
@@ -85,22 +85,9 @@ Run SurfSense on your own infrastructure for full data control and privacy.
 curl -fsSL https://raw.githubusercontent.com/MODSetter/SurfSense/main/docker/scripts/install.sh | bash
 ```
 
-For Docker Compose and other deployment options, see the [Docker Installation docs](https://www.surfsense.com/docs/docker-installation).
+The install script sets up [Watchtower](https://github.com/nicholas-fedor/watchtower) automatically for daily auto-updates. To skip it, add the `--no-watchtower` flag.
 
-**Update (recommended — Watchtower):**
-
-```bash
-docker run -d --name watchtower -v /var/run/docker.sock:/var/run/docker.sock nickfedor/watchtower --label-enable --interval 86400
-```
-
-**Update (manual):**
-
-```bash
-cd surfsense   # or SurfSense/docker if you used Option 2
-docker compose pull && docker compose up -d
-```
-
-For manual installation and other deployment options, check the [docs](https://www.surfsense.com/docs/).
+For Docker Compose, manual installation, and other deployment options, see the [docs](https://www.surfsense.com/docs/).
 
 ### How to Realtime Collaborate (Beta)
 
diff --git a/docker/scripts/install.sh b/docker/scripts/install.sh
index 4fa80cfb3..0f0923a94 100644
--- a/docker/scripts/install.sh
+++ b/docker/scripts/install.sh
@@ -1,8 +1,14 @@
 #!/usr/bin/env bash
 # =============================================================================
 # SurfSense — One-line Install Script
+#
+#
 # Usage: curl -fsSL https://raw.githubusercontent.com/MODSetter/SurfSense/main/docker/scripts/install.sh | bash
 #
+# Flags:
+#   --no-watchtower              Skip automatic Watchtower setup
+#   --watchtower-interval=SECS   Check interval in seconds (default: 86400 = 24h)
+#
 # Handles two cases automatically:
 #   1. Fresh install        — no prior SurfSense data detected
 #   2. Migration from the legacy all-in-one container (surfsense-data volume)
@@ -23,6 +29,17 @@ OLD_VOLUME="surfsense-data"
 DUMP_FILE="./surfsense_migration_backup.sql"
 KEY_FILE="./surfsense_migration_secret.key"
 MIGRATION_MODE=false
+SETUP_WATCHTOWER=true
+WATCHTOWER_INTERVAL=86400
+WATCHTOWER_CONTAINER="watchtower"
+
+# ── Parse flags ─────────────────────────────────────────────────────────────
+for arg in "$@"; do
+    case "$arg" in
+        --no-watchtower) SETUP_WATCHTOWER=false ;;
+        --watchtower-interval=*) WATCHTOWER_INTERVAL="${arg#*=}" ;;
+    esac
+done
 
 CYAN='\033[1;36m'
 YELLOW='\033[1;33m'
@@ -231,6 +248,34 @@ else
     success "All services started."
 fi
 
+# ── Watchtower (auto-update) ─────────────────────────────────────────────────
+
+if $SETUP_WATCHTOWER; then
+    step "Setting up Watchtower (auto-updates every $((WATCHTOWER_INTERVAL / 3600))h)"
+
+    WT_STATE=$(docker inspect -f '{{.State.Running}}' "${WATCHTOWER_CONTAINER}" 2>/dev/null || echo "missing")
+
+    if [[ "${WT_STATE}" == "true" ]]; then
+        success "Watchtower is already running — skipping."
+    else
+        if [[ "${WT_STATE}" != "missing" ]]; then
+            info "Removing stopped Watchtower container..."
+            docker rm -f "${WATCHTOWER_CONTAINER}" >/dev/null 2>&1 || true
+        fi
+        docker run -d \
+            --name "${WATCHTOWER_CONTAINER}" \
+            --restart unless-stopped \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            nickfedor/watchtower \
+            --label-enable \
+            --interval "${WATCHTOWER_INTERVAL}" >/dev/null 2>&1 \
+            && success "Watchtower started — labeled SurfSense containers will auto-update." \
+            || warn "Could not start Watchtower. You can set it up manually or use: docker compose pull && docker compose up -d"
+    fi
+else
+    info "Skipping Watchtower setup (--no-watchtower flag)."
+fi
+
 # ── Done ─────────────────────────────────────────────────────────────────────
 
 echo ""
@@ -267,6 +312,13 @@ info "  Stop:      cd ${INSTALL_DIR} && ${DC} down"
 info "  Update:    cd ${INSTALL_DIR} && ${DC} pull && ${DC} up -d"
 info ""
 
+if $SETUP_WATCHTOWER; then
+    info "  Watchtower: auto-updates every $((WATCHTOWER_INTERVAL / 3600))h (stop: docker rm -f ${WATCHTOWER_CONTAINER})"
+else
+    warn "  Watchtower skipped. For auto-updates, re-run without --no-watchtower."
+fi
+info ""
+
 if $MIGRATION_MODE; then
     warn "  Migration complete! Open frontend and verify your data."
     warn "  Once verified, clean up the legacy volume and dump file:"
diff --git a/surfsense_web/content/docs/docker-installation.mdx b/surfsense_web/content/docs/docker-installation.mdx
index 52479a961..9cabb0049 100644
--- a/surfsense_web/content/docs/docker-installation.mdx
+++ b/surfsense_web/content/docs/docker-installation.mdx
@@ -9,7 +9,7 @@ This guide explains how to run SurfSense using Docker, with options ranging from
 
 ### Option 1 — Install Script (recommended)
 
-Downloads the compose files, generates a `SECRET_KEY`, and starts all services automatically:
+Downloads the compose files, generates a `SECRET_KEY`, starts all services, and sets up [Watchtower](https://github.com/nicholas-fedor/watchtower) for automatic daily updates:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/MODSetter/SurfSense/main/docker/scripts/install.sh | bash
@@ -17,6 +17,14 @@ curl -fsSL https://raw.githubusercontent.com/MODSetter/SurfSense/main/docker/scr
 
 This creates a `./surfsense/` directory with `docker-compose.yml` and `.env`, then runs `docker compose up -d`.
 
+To skip Watchtower (e.g. in production where you manage updates yourself):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MODSetter/SurfSense/main/docker/scripts/install.sh | bash -s -- --no-watchtower
+```
+
+To customise the check interval (default 24h), use `--watchtower-interval=SECONDS`.
+
 ### Option 2 — Manual Docker Compose
 
 ```bash
@@ -40,8 +48,13 @@ After starting, access SurfSense at:
 
 **Option 1 — Watchtower daemon (recommended, auto-updates every 24 h):**
 
+If you used the install script (Option 1 above), Watchtower is already running. No extra setup needed.
+
+For manual Docker Compose installs (Option 2), start Watchtower separately:
+
 ```bash
 docker run -d --name watchtower \
+  --restart unless-stopped \
   -v /var/run/docker.sock:/var/run/docker.sock \
   nickfedor/watchtower \
   --label-enable \