diff --git a/jellyfin/arr-stack/watchtower-update.sh b/jellyfin/arr-stack/watchtower-update.sh
new file mode 100644
index 0000000..1e82c45
--- /dev/null
+++ b/jellyfin/arr-stack/watchtower-update.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# Watchtower run-once update script
+# Usage: watchtower-update.sh [scope]
+# If scope is given, only updates containers with that scope label.
+# If no scope, updates all unscoped containers.
+
+SCOPE=$1
+NAME="watchtower-${SCOPE:-main}-$$"
+
+ARGS=(
+  --rm
+  --name "$NAME"
+  -v /var/run/docker.sock:/var/run/docker.sock
+  -v /home/jgitta/.docker/config.json:/config.json:ro
+  -e TZ=America/Chicago
+  -e WATCHTOWER_NOTIFICATIONS=email
+  -e WATCHTOWER_NOTIFICATION_EMAIL_FROM=jgitta@jgitta.com
+  -e WATCHTOWER_NOTIFICATION_EMAIL_TO=jgitta@jgitta.com
+  -e WATCHTOWER_NOTIFICATION_EMAIL_SERVER=smtp.fastmail.com
+  -e WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PORT=587
+  -e WATCHTOWER_NOTIFICATION_EMAIL_SERVER_USER=jgitta@jgitta.com
+  -e WATCHTOWER_NOTIFICATION_EMAIL_SERVER_PASSWORD=2l79229z6r4y8x8y
+  -e WATCHTOWER_NOTIFICATIONS_LEVEL=warn
+  -e WATCHTOWER_CLEANUP=true
+)
+
+if [ -n "$SCOPE" ]; then
+  ARGS+=(-e WATCHTOWER_SCOPE="$SCOPE")
+fi
+
+docker run "${ARGS[@]}" containrrr/watchtower --run-once