From 323e0f87f9e9a3b2df4026fb6c07d74dc337529c Mon Sep 17 00:00:00 2001
From: jpelchat <83721525+jpelchat@users.noreply.github.com>
Date: Mon, 23 Mar 2026 08:42:45 -0400
Subject: [PATCH] docs/windows/policy: add CheckUpdates key to tailscale.admx
 (#19044)

Fixes: #19014
Signed-off-by: Jacob Pelchat <jacob@tailscale.com>
---
 docs/windows/policy/en-US/tailscale.adml | 10 ++++++++++
 docs/windows/policy/tailscale.admx       | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/docs/windows/policy/en-US/tailscale.adml b/docs/windows/policy/en-US/tailscale.adml
index a0be5e831..225c1a8d4 100644
--- a/docs/windows/policy/en-US/tailscale.adml
+++ b/docs/windows/policy/en-US/tailscale.adml
@@ -178,6 +178,16 @@ If you disable this policy, then Automatically Install Updates is always disable
 If you do not configure this policy, then Automatically Install Updates depends on what is selected in the Preferences submenu.
 
 See https://tailscale.com/kb/1067/update#auto-updates for more details.]]></string>
+            <string id="CheckUpdates">Automatically check for updates</string>
+            <string id="CheckUpdates_Help"><![CDATA[This policy can be used to control whether the Tailscale client periodically checks for updates.
+
+If you enable this policy, then update checks are always enabled.
+
+If you disable this policy, then update checks are always disabled.
+
+If you do not configure this policy, then update checks are enabled, but the user may disable them manually.
+
+See https://tailscale.com/docs/features/client/update for more details.]]></string>
             <string id="AdvertiseExitNode">Run Tailscale as an Exit Node</string>
             <string id="AdvertiseExitNode_Help"><![CDATA[This policy can be used to require that Run Exit Node is configured a certain way.
 
diff --git a/docs/windows/policy/tailscale.admx b/docs/windows/policy/tailscale.admx
index 7cc174b06..77d37dc69 100644
--- a/docs/windows/policy/tailscale.admx
+++ b/docs/windows/policy/tailscale.admx
@@ -259,6 +259,16 @@
         <string>never</string>
       </disabledValue>
     </policy>
+    <policy name="CheckUpdates" class="Machine" displayName="$(string.CheckUpdates)" explainText="$(string.CheckUpdates_Help)" key="Software\Policies\Tailscale" valueName="CheckUpdates">
+      <parentCategory ref="Settings_Category" />
+      <supportedOn ref="PARTIAL_FULL_SINCE_V1_56" />
+      <enabledValue>
+        <string>always</string>
+      </enabledValue>
+      <disabledValue>
+        <string>never</string>
+      </disabledValue>
+    </policy>
     <policy name="AdvertiseExitNode" class="Machine" displayName="$(string.AdvertiseExitNode)" explainText="$(string.AdvertiseExitNode_Help)" key="Software\Policies\Tailscale" valueName="AdvertiseExitNode">
       <parentCategory ref="Settings_Category" />
       <supportedOn ref="PARTIAL_FULL_SINCE_V1_56" />