Firmware updates ship as whole signed builds the hub pulls down itself. They install when the hub is idle and roll back automatically if the new build fails to come back up. Nothing about your setup — rooms, scenes, paired bulbs — is touched by an update.
How it works
The hub periodically checks dl.rhythm.lighting for a newer
build than the one it's running. If auto-update is on
(the default), it downloads the build, verifies its checksum, writes it to
the spare system partition, and reboots into it. The whole thing is a
single self-contained image, so there's no half-updated state to get stuck
in.
Stable and beta
The auto-update toggle also chooses which feed the hub follows:
- Auto-update on → stable. A curated feed; the hub applies new builds on its own.
- Auto-update off → beta. A faster-moving feed; the hub checks but only installs when you tell it to.
Turn auto-update off in the app's settings if you'd rather review every update before it lands.
Rollback
The hub keeps two system partitions — the one it's running and the one it updates into. After an update it reboots into the new partition and waits for the system to come up healthy. If it doesn't, the bootloader falls back to the previous, known-good partition automatically. A bad update can't brick the hub; worst case you're back where you started.
Updating manually
With auto-update off, the app surfaces "Update available" when the beta feed has something newer. Approving it runs the same download → verify → stage → reboot flow, on your command instead of on a timer.