macOS softwareupdate: Disabling Updates, Fetching Installers

softwareupdate is how macOS installs its own updates from the Terminal — check what is available, download it, install it, and, where the machine still allows it, hold updates back. The recurring trap is that the command has been narrowed over several releases, so a flag copied from an older guide can be typed perfectly and still fail. This page stays with what actually runs on macOS 26.5.2: seeing what is offered, installing it, pulling down a full installer, and stopping the Mac from updating on its own — plus the handful of flags that look alive and aren’t.

See what updates are available

One subcommand runs without administrator authentication, and it is the one to start with:

softwareupdate --list

It prints the update labels Apple currently offers this Mac. Two symbols in that output decide what the install commands below will touch: a * marks a recommended update, and a - marks one that isn’t. The man page notes non-recommended updates are uncommon, so most of the time the two sets are identical — but the distinction is exactly what --recommended keys off. Everything past --list prompts for a password.

Two flags refine the scan when the default is too broad: --no-scan reuses a previous scan instead of contacting Apple again, and --product-types macOS (or --product-types Safari) limits the listing to one kind of update.

Install updates

# Install everything recommended, restarting if an update needs it
sudo softwareupdate --install --recommended --restart

# Install one item, named exactly as --list printed it
sudo softwareupdate --install "macOS Tahoe 26.5.2-25F84"

# Only the macOS update, or only Safari
sudo softwareupdate --install --os-only
sudo softwareupdate --install --safari-only

--restart reboots gracefully if someone is logged in and forces the reboot if not; add --force when you always want the forced path. One difference trips deployment scripts carried over from Intel Macs: --user and --stdinpass are Apple silicon only, because an install there needs a volume owner’s credentials that an Intel Mac never asked for.

Download a full macOS installer

To pull a complete installer rather than an incremental update, name the version you want:

softwareupdate --fetch-full-installer --full-installer-version 26.5.2

Check what is actually fetchable first, because the catalog is shorter than people expect:

softwareupdate --list-full-installers

On macOS 26.5.2, as of July 2026, that list returns macOS Tahoe builds from 26.1 to 26.5.2 and macOS Sequoia 15.7.x — and stops there. No Sonoma, no Ventura, nothing older. Two separate limits produce that. The --fetch-full-installer and --full-installer-version flags only exist from macOS Catalina (10.15) onward, so a Mac older than that won’t recognise them at all; and even on a current Mac, you can only fetch a version Apple still publishes. Ask for one that isn’t on --list-full-installers and it fails regardless of which Mac runs it. Listing first turns that into a single step instead of two failed downloads.

For an installer older than the catalog reaches, Apple’s own download links — documented on Apple Support — or a tool like Mist are the realistic routes.

Stop macOS from updating itself

The flag people reach for here — --ignore — was removed in macOS Big Sur, so it no longer exists to disable anything (the next section shows what it does now). Turning off automatic behaviour is done by writing the preference keys directly, each one independent:

# Stop the automatic check
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -bool false

# Stop background downloads
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -bool false

# Stop automatic macOS upgrade installs
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool false

# Stop App Store auto-updates
sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdate -bool false

These write to the machine-level domain in /Library/Preferences, so they need sudo and apply to the whole Mac rather than one account. Confirm the automatic check took, using a flag --help never mentions:

$ softwareupdate --schedule
Automatic checking for updates is turned on

If that still reports on after the write, something didn’t take. And be clear about the limit: this is a preference, not a lock. The same keys back the switches in System Settings, so anyone with admin rights can turn them back on. For updates a user cannot re-enable, the preference domain is the wrong layer — that is what MDM and configuration profiles are for, and it is the path Apple opened as it closed --ignore.

Flags that look alive but aren’t

Two flags still circulate in guides, and they fail in two different ways. --ignore is rejected outright — on macOS 26.5.2 it returns the same message as an option that was never real:

$ softwareupdate --ignore '*'
softwareupdate: unrecognized option `--ignore'
usage: softwareupdate <cmd> [<args> ...]

--clear-catalog is the more dangerous one, because it looks like it worked. It still parses, prints a single line, and exits without touching anything:

$ softwareupdate --clear-catalog
Catalog management is no longer supported.

Nothing was cleared, but the exit status is success — a script checking $? would record a win. That is precisely how the flag stayed in circulation long after it stopped doing its job.

Part of the confusion is that the two obvious references disagree about what exists. On macOS 26.5.2, man softwareupdate and softwareupdate --help do not list the same options:

Option	In man	In --help
--schedule	Documented	Not listed
--history	Not mentioned	Listed
--no-scan, --product-types	Not mentioned	Listed
--dump-state, --evaluate-products	Not mentioned	Listed
--clear-catalog	Not mentioned	Not listed
--ignore	Not mentioned	Not listed

Read only the man page and you would never find --history or --no-scan; read only --help and you would never find --schedule. The two flags that mislead — --clear-catalog and --ignore — sit in neither.

When a command from a guide fails

The pattern behind all of this is a single one: softwareupdate has been narrowed on purpose across releases, with update policy moving to MDM and configuration profiles and installer fetching limited to the versions Apple still ships. So when a command copied from somewhere returns “unrecognized option,” the useful move is to check --help on the Mac in front of you rather than trust a page written for a different macOS. The binary is the one reference that can’t be out of date.