Installing macOS updates unattended from the command line with softwareupdate

Goal

Check for and install macOS updates from a script, without the graphical System Settings pane.

Prerequisites

Terminal, admin credentials for install; on Apple silicon, some installer-fetch operations must run as, or be authorized by, a volume owner.

Steps

1. List what's available: softwareupdate --list (or -l). Updates the OS is currently deferring under a managed policy may not appear until the deferral window elapses.
2. Install everything and restart automatically if required: sudo softwareupdate --install --all --restart. No confirmation prompt appears on Intel Macs. On Apple silicon, installing macOS updates (not only full installers) needs volume-owner authorization: pass --user <owner> --stdinpass in a script, or let the MDM server send the update command, which is the managed path. Piping a password into a script is a secret-handling decision, not a convenience flag.
3. Install one named update instead of all of them: sudo softwareupdate --install "macOS Sequoia 15.6-24G84", using the label from --list.
4. Download a full macOS installer application rather than a delta update: softwareupdate --fetch-full-installer --full-installer-version 15.6. On Apple silicon this requires authorization as a volume owner; supply it non-interactively with --user <owner> --stdinpass (reads the password from stdin) — both flags are Apple-silicon-only and have no effect on an Intel Mac.
5. List downloadable full installers first if the exact version string is unknown: softwareupdate --list-full-installers.
6. Verify afterwards: sw_vers -productVersion, and check /var/log/install.log for the package's completion line.

Expected result

--install exits 0 and the requested label disappears from a subsequent --list; sw_vers reports the new build after the reboot.

Limits and test basis

Flag syntax and the Apple-silicon-only authentication flags come from a command reference, since Apple does not publish softwareupdate's flags as a web page. Managed deferral and enforcement of software updates through device management is documented in Apple's platform deployment guide; an enrolled Mac will not offer or install a deferred update through this command until the window passes. softwareupdate has no rollback subcommand; verify a current backup exists (see the Time Machine methodology in this series) before a major upgrade.