diff --git a/README.md b/README.md
index 2efff9a..5dc1844 100644
--- a/README.md
+++ b/README.md
@@ -99,7 +99,17 @@ Deploy a fresh clone with:
 ```sh
 git clone https://git.add-ideas.de/lotobo/toolbox-portal.git
 cd toolbox-portal
-docker compose up -d --build
+./scripts/deploy-update.sh
+```
+
+If you prefer the inline command:
+
+```sh
+git fetch origin --tags && \
+git pull --ff-only origin main && \
+{ TAG="$(git describe --tags --exact-match 2>/dev/null || git describe --tags --abbrev=0 2>/dev/null || true)"; \
+  if [ -n "$TAG" ]; then echo "$TAG"; else echo "warning: no matching tags found"; fi; } && \
+docker compose up -d --build && \
 docker compose ps
 ```
 
diff --git a/scripts/deploy-update.sh b/scripts/deploy-update.sh
new file mode 100644
index 0000000..d1e68e4
--- /dev/null
+++ b/scripts/deploy-update.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+cd "${PROJECT_DIR}"
+
+git fetch origin --tags
+git pull --ff-only origin main
+
+if ! TAG="$(git describe --tags --exact-match 2>/dev/null)"; then
+  TAG="$(git describe --tags --abbrev=0 2>/dev/null || true)"
+  if [ -z "${TAG}" ]; then
+    echo "warning: current commit is untagged and no tagged ancestor was found"
+  else
+    echo "warning: current commit is untagged; nearest tag is ${TAG}"
+  fi
+else
+  echo "tagged: ${TAG}"
+fi
+
+docker compose up -d --build
+docker compose ps