diff --git a/crates/app-contract/CHANGELOG.md b/crates/app-contract/CHANGELOG.md
index 2a0583f..97ee814 100644
--- a/crates/app-contract/CHANGELOG.md
+++ b/crates/app-contract/CHANGELOG.md
@@ -12,6 +12,8 @@ that holds 1.2.0.
 
 ## 1.12.0 — unreleased
 
+- `RESERVED_NAMES` gains `updater`: OctoSense's native Updates window. No
+  store app may take `updater` as its id or namespace.
 - Add the optional `window` manifest field (`WindowHint { width, height }`,
   with `WindowHint::new`): the size, in points, at which the app prefers its
   desktop window to open. It is a hint, not a grant: hosts clamp it to the
diff --git a/crates/app-contract/src/manifest.rs b/crates/app-contract/src/manifest.rs
index 9118296..1f9431f 100644
--- a/crates/app-contract/src/manifest.rs
+++ b/crates/app-contract/src/manifest.rs
@@ -863,7 +863,8 @@ pub fn short_id(app_id: &str) -> &str {
 ///   checks this list against that file): `apphub`, `appcard`, `reference`,
 ///   `rinx`, `sheets`, `terminal`, and the Makepad apps it has made native
 ///   apps: `calculator`, `clock`, `notes`, `reminders`, `weather`, and the
-///   desktop-only `browser` and `task`. Their tools (`notes.search`,
+///   desktop-only `browser` and `task`; and `updater`, its host-owned
+///   Updates window, which has no tools. Their tools (`notes.search`,
 ///   `calculator.eval`, `browser.tabs`, …) are named by OctoSense's grants,
 ///   so no store app may declare them. A Makepad app is reserved here when
 ///   OctoSense makes it native, not before.
@@ -878,7 +879,8 @@ pub fn short_id(app_id: &str) -> &str {
 /// not by its name.
 pub const RESERVED_NAMES: &[&str] = &[
     "agents", "apphub", "appcard", "browser", "calculator", "card", "clock", "dev", "notes", "octos", "octoscode", "os",
-    "reference", "reminders", "rinx", "sheets", "shell", "system", "task", "terminal", "toolbox", "weather", "workflow",
+    "reference", "reminders", "rinx", "sheets", "shell", "system", "task", "terminal", "toolbox", "updater", "weather",
+    "workflow",
 ];
 
 /// Exact app ids which would collide with host-owned files beneath an install