On a developer Mac, turn on all three automatic update options in System Settings, General, Software Update: download updates, install macOS updates, and install security responses and system files. Developers who disable updates to protect a toolchain usually end up unpatched for months. A staged approach is safer.
The three switches
Apple's guide describes them. Open System Settings, click General, then Software Update, then the Info button next to Automatic Updates.
- Download new updates when available downloads without asking.
- Install macOS updates installs them automatically.
- Install Security Responses and system files automatically installs system files and Rapid Security Responses.
Apple adds one practical condition: laptops must be plugged into a power adapter to download updates automatically. A laptop that is always on battery will lag. Remind people to plug in overnight.
Why developers resist, and what to do about it
The honest reason is breakage. A major macOS release can break a compiler, a virtualisation tool, a container runtime or a signing setup. People then turn everything off.
A better pattern:
- Keep the security response and system file option on.
- Keep download on, so updates are ready.
- For major version upgrades, wait a short, defined window and test on one volunteer machine first.
- Set a limit, for example that every laptop is on a supported release within a stated number of weeks. Choose a number you can keep.
- Tell people which tools are known to need attention before an upgrade, and keep that list in your onboarding doc.
Your policy decides the exact window. The point is to have one, not to leave it to individual patience.
What updating does not cover
The operating system is one layer. A developer laptop also has package managers, language runtimes, container images, browser extensions and IDE plugins. Each has its own update path.
- Language runtimes and global packages: update them on a schedule too.
- Browser and IDE extensions: remove ones you do not use. See how to vet a VS Code extension.
- Project dependencies: scanning belongs in the project, not on the laptop alone. Safeguard Desktop and the Safeguard CLI can scan project dependencies locally, and there is a free scan at gold.safeguard.sh/scan.
How to check a fleet
For a handful of Macs, ask people to screenshot the Software Update pane once a quarter. For more, use your device management tool to report OS versions and flag those behind. Do not rely on memory.
Combine with FileVault and the host firewall as a three item baseline.
Quick check
Do automatic updates work when the laptop is on battery?
Per Apple, laptops must be plugged into a power adapter to download updates automatically.
Sources
Last reviewed: 19 October 2026.
