diff --git a/scripts/update-check.mjs b/scripts/update-check.mjs
index 21b1075..f5ae9de 100644
--- a/scripts/update-check.mjs
+++ b/scripts/update-check.mjs
@@ -12,7 +12,7 @@
  *   node scripts/update-check.mjs --dry-run  # report only, change nothing
  */
 import { spawnSync } from 'node:child_process';
-import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { ensurePythonDeps } from './ensure-python-deps.mjs';
@@ -25,6 +25,24 @@ const PORT = process.env.AUTOFIRMER_PORT ?? '3000';
 const BASE = `http://127.0.0.1:${PORT}`;
 const DRY_RUN = process.argv.includes('--dry-run');
 const STALE_LOCK_MS = 60 * 60 * 1000;
+const LOG_MAX_BYTES = 256 * 1024;
+const LOG_KEEP_LINES = 500;
+
+/**
+ * Keep update.log from growing without bound.
+ *
+ * Trimmed once per run, before anything is written, rather than on every line:
+ * the no-change path writes nothing at all, so this is the only moment the file
+ * can have grown since last time. Housekeeping must never break an update, so
+ * any failure here is swallowed.
+ */
+function trimLog() {
+    try {
+        if (!existsSync(LOG_FILE) || statSync(LOG_FILE).size <= LOG_MAX_BYTES) return;
+        const kept = readFileSync(LOG_FILE, 'utf8').split('\n').filter(Boolean).slice(-LOG_KEEP_LINES);
+        writeFileSync(LOG_FILE, kept.join('\n') + '\n');
+    } catch { /* ignore */ }
+}
 
 function log(msg) {
     const line = `${new Date().toISOString()}  ${msg}`;
@@ -63,6 +81,7 @@ const releaseLock = () => { try { rmSync(LOCK_FILE, { force: true }); } catch {
 
 async function main() {
     mkdirSync(path.join(ROOT, 'scripts'), { recursive: true });
+    trimLog();
 
     if (!DRY_RUN && !acquireLock()) {
         console.log('another update is already running — exiting');