diff --git a/bootstrap.sh b/bootstrap.sh
index 440305e..3c4c430 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -241,8 +241,9 @@ echo "[bootstrap] installing sync mechanism for $OS"
 run "bash '$CLONE_DIR/scripts/sync/install.sh'"
 
 # -------- install homelab CLI --------
-echo "[bootstrap] installing homelab CLI to /usr/local/bin/homelab"
-run "install -m 0755 '$CLONE_DIR/bin/homelab' /usr/local/bin/homelab"
+# Symlink rather than copy so the 5-min sync auto-updates the CLI.
+echo "[bootstrap] linking homelab CLI to /usr/local/bin/homelab"
+run "ln -sfn '$CLONE_DIR/bin/homelab' /usr/local/bin/homelab"
 
 # -------- AGENTS.md symlink --------
 case "$OS" in
diff --git a/operations/agent-enrollment.md b/operations/agent-enrollment.md
index ca8cbe6..e9e6786 100644
--- a/operations/agent-enrollment.md
+++ b/operations/agent-enrollment.md
@@ -203,6 +203,8 @@ The CLI prints a follow-up checklist that the operator must do manually:
 | `Invalid Host header` from MCP server | FastMCP's DNS-rebinding protection (default whitelist is 127.0.0.1 only) | Fixed in commit `6848640`; pull latest `mcp/server.py` and redeploy |
 | `python3-yaml` install fails on Fedora | Wrong package name | Use `python3-pyyaml` (Fedora) instead of `python3-yaml` (Debian) |
 | `address already in use` for FastMCP | FastMCP defaults to 127.0.0.1:8000 | Fixed: server now sets `mcp.settings.host/port` from env (default `0.0.0.0:9810`) |
+| `homelab: no age key at /etc/age/key.txt` even after bootstrap | `/etc/age` is 0700 root, so non-root users couldn't even stat the key file; existence check returned False under regular users | Fixed in commit `df6aca8`: the CLI re-execs `sops -d` via sudo when invoked as a non-root user. On older deployments, re-link the CLI with `sudo ln -sfn /opt/homelab-context/bin/homelab /usr/local/bin/homelab` after the 5-min sync. |
+| `homelab` CLI doesn't pick up repo updates | Pre-`02db…` bootstrap copied the binary instead of symlinking | One-time migration: `sudo ln -sfn /opt/homelab-context/bin/homelab /usr/local/bin/homelab`. New bootstraps use the symlink, which auto-tracks the synced repo. |
 
 ## Changelog