diff --git a/src/cli/update-cli/update-command.ts b/src/cli/update-cli/update-command.ts
index abc9c0080c7..ec04f2dd876 100644
--- a/src/cli/update-cli/update-command.ts
+++ b/src/cli/update-cli/update-command.ts
@@ -12,6 +12,7 @@ import {
 } from "../../config/config.js";
 import { formatConfigIssueLines } from "../../config/issue-format.js";
 import { resolveGatewayService } from "../../daemon/service.js";
+import { cleanStaleGatewayProcessesSync } from "../../infra/restart-stale-pids.js";
 import {
   channelToNpmTag,
   DEFAULT_GIT_CHANNEL,
@@ -590,9 +591,19 @@ async function maybeRestartService(params: {
         }
       }
       if (params.restartScriptPath) {
+        // A managed service restart script is available: kill stale bare-process
+        // gateway PIDs first so the service can bind the port on the way up.
+        // We only do this when we have a guaranteed restart path — killing the
+        // live gateway without a viable replacement would leave it down.
+        cleanStaleGatewayProcessesSync();
         await runRestartScript(params.restartScriptPath);
         restartInitiated = true;
       } else {
+        // No restart script — fall back to daemon restart.  Skip the proactive
+        // PID cleanup here: if the daemon is not loaded runDaemonRestart returns
+        // false and we would kill the live gateway with no replacement.  The
+        // post-restart health check (waitForGatewayHealthyRestart) already
+        // handles stale PID cleanup once the new gateway is confirmed healthy.
         restarted = await runDaemonRestart();
       }