diff --git a/cmd/kctl-tui/main.go b/cmd/kctl-tui/main.go
index 6c1e386..e7745b4 100644
--- a/cmd/kctl-tui/main.go
+++ b/cmd/kctl-tui/main.go
@@ -83,8 +83,18 @@ func main() {
 		}
 	}
 
-	if checkForUpdateInteractive(verbose) {
-		os.Exit(0)
+	// Load config early to check auto_update_update and validate.
+	cfgPath, err := config.DefaultPath()
+	if err == nil {
+		cfg, cfgErr := config.Load(cfgPath)
+		if cfgErr != nil {
+			fmt.Fprintf(os.Stderr, "WARNING: failed to load config: %v\n", cfgErr)
+		}
+		if cfgErr == nil && cfg.IsAutoUpdateCheckEnabled() {
+			if checkForUpdateInteractive(verbose) {
+				os.Exit(0)
+			}
+		}
 	}
 
 	m := newFullModel()
diff --git a/cmd/kctl-tui/update.go b/cmd/kctl-tui/update.go
index 7e5a940..c9572e2 100644
--- a/cmd/kctl-tui/update.go
+++ b/cmd/kctl-tui/update.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/Masterminds/semver/v3"
 	"github.com/creativeprojects/go-selfupdate"
+	"golang.org/x/term"
 )
 
 const (
@@ -88,6 +89,10 @@ func checkForUpdateInteractive(verbose bool) bool {
 		return false
 	}
 
+	if !term.IsTerminal(int(os.Stdin.Fd())) {
+		return false
+	}
+
 	updater, err := initUpdater(verbose)
 	if err != nil {
 		if verbose {
diff --git a/config.example.yaml b/config.example.yaml
index 3c281d1..8b98a44 100644
--- a/config.example.yaml
+++ b/config.example.yaml
@@ -60,3 +60,7 @@ team_label_key: "example.org/team"
 # wraps SSO login in a custom script or needs a specific --profile, e.g.:
 #   aws_sso_login_command: "aws sso login --profile my-profile"
 aws_sso_login_command: "aws sso login"
+
+# Check for updates on startup and prompt to update if a newer version is
+# available. Set to false to disable. Defaults to true if omitted.
+# auto_update_check: true
diff --git a/go.mod b/go.mod
index 1abc16a..0e7e45d 100644
--- a/go.mod
+++ b/go.mod
@@ -7,6 +7,7 @@ require (
 	github.com/charmbracelet/bubbles v0.21.1
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/creativeprojects/go-selfupdate v1.6.0
+	golang.org/x/term v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
diff --git a/internal/config/config.go b/internal/config/config.go
index 63a15f3..d2eb388 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -62,6 +62,19 @@ type Config struct {
 	// AWSSSOLoginCommand is run interactively if an AWS auth check fails
 	// before the secrets workflow (e.g. an expired SSO session).
 	AWSSSOLoginCommand string `yaml:"aws_sso_login_command"`
+
+	// AutoUpdateCheck controls whether kctl-tui checks for updates on
+	// startup. Defaults to true when omitted.
+	AutoUpdateCheck *bool `yaml:"auto_update_check"`
+}
+
+// IsAutoUpdateCheckEnabled returns true unless the user has explicitly set
+// auto_update_check to false in their config.
+func (c Config) IsAutoUpdateCheckEnabled() bool {
+	if c.AutoUpdateCheck == nil {
+		return true
+	}
+	return *c.AutoUpdateCheck
 }
 
 // LoginCommand returns the configured AWS SSO login command, falling back