diff --git a/.devcontainer/init-plugins.sh b/.devcontainer/init-plugins.sh
index 7b27424..79dec5b 100755
--- a/.devcontainer/init-plugins.sh
+++ b/.devcontainer/init-plugins.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # Initialize Claude Code plugins for the devcontainers repo
-# This script is idempotent - safe to run multiple times
+# This script is idempotent - safe to run multiple times; each run also updates plugins
 
 set -euo pipefail
 
@@ -44,6 +44,19 @@ for plugin in "${PLUGINS[@]}"; do
     }
 done
 
+# ~/.claude is a persistent volume, so `install` no-ops after the first run.
+# Refresh marketplace indexes first — `plugin update` resolves against the cache.
+echo "Updating Claude Code plugins..."
+claude plugin marketplace update || {
+    echo "Note: marketplace refresh failed; updates use cached indexes"
+}
+for plugin in "${PLUGINS[@]}"; do
+    echo "  Updating: $plugin"
+    claude plugin update "$plugin" 2>/dev/null || {
+        echo "    Note: $plugin update failed or unavailable"
+    }
+done
+
 # Initialize rtk global hook for Claude Code (auto-rewrite mode).
 # --hook-only: installs only the PreToolUse rewrite hook, no workspace artifacts.
 # Telemetry consent prompt: RTK_TELEMETRY_DISABLED=1 opts out (rtk-ai/rtk#2477),
diff --git a/claude-code/.devcontainer/init-plugins.sh b/claude-code/.devcontainer/init-plugins.sh
index 1f97113..ebcf56c 100755
--- a/claude-code/.devcontainer/init-plugins.sh
+++ b/claude-code/.devcontainer/init-plugins.sh
@@ -1,9 +1,10 @@
 #!/bin/bash
-# Claude Code plugin initialization. Idempotent — safe to run multiple times.
+# Claude Code plugin initialization. Idempotent — safe to run multiple times;
+# each run also updates plugins to latest.
 #
 # Sandbox variant: runs from postCreateCommand, before the firewall comes up.
-# Default variant: run `bash .devcontainer/init-plugins.sh` once after signing in —
-# from postCreateCommand it races the extension's OAuth sign-in (#58).
+# Default variant: run `bash .devcontainer/init-plugins.sh` after signing in, and to
+# update plugins — from postCreateCommand it races the extension's OAuth sign-in (#58).
 
 set -euo pipefail
 
@@ -66,6 +67,22 @@ for plugin in "${PLUGINS[@]}"; do
     fi
 done
 
+# ~/.claude is a persistent volume, so `install` no-ops after the first run.
+# Refresh marketplace indexes first — `plugin update` resolves against the cache.
+if claude plugin marketplace update 2>&1; then
+    echo "✔ Marketplaces refreshed"
+else
+    echo "⚠ Failed to refresh marketplaces" >&2
+fi
+
+for plugin in "${PLUGINS[@]}"; do
+    if claude plugin update "$plugin" 2>&1; then
+        echo "✔ Up to date: $plugin"
+    else
+        echo "⚠ Failed to update: $plugin" >&2
+    fi
+done
+
 # ── Playwright MCP: route every cached .mcp.json to system chromium ─────────
 # Universal across arches (no Chrome stable binary in either default or sandbox).
 # The patch binary is baked into the image (see Dockerfile #87) and also runs
diff --git a/claude-code/README.md b/claude-code/README.md
index 269677d..f84a814 100644
--- a/claude-code/README.md
+++ b/claude-code/README.md
@@ -80,10 +80,10 @@ Only pin tools that affect project stability — dev infrastructure (rtk, ralphe
 
 ### Optional: `.devcontainer/init-plugins.sh`
 
-Claude Code plugin initialization. `init-plugins.sh` registers marketplaces, installs plugins, and invokes the image-baked `/usr/local/bin/patch-playwright-mcp` to rewrite every cached Playwright MCP `.mcp.json` to launch the system chromium. Idempotent. See [`.devcontainer/init-plugins.sh`](.devcontainer/init-plugins.sh) for the template.
+Claude Code plugin initialization. `init-plugins.sh` registers marketplaces, installs plugins, updates them to the latest marketplace versions (`install` alone no-ops once the persistent `~/.claude` volume holds a plugin), and invokes the image-baked `/usr/local/bin/patch-playwright-mcp` to rewrite every cached Playwright MCP `.mcp.json` to launch the system chromium. Idempotent. See [`.devcontainer/init-plugins.sh`](.devcontainer/init-plugins.sh) for the template.
 
 - **Sandbox variant:** its `postCreateCommand` already runs the script, if present, before `postStartCommand` brings up the firewall.
-- **Default variant:** run it once yourself after signing in to Claude Code:
+- **Default variant:** run it yourself after signing in to Claude Code, and again whenever you want plugin updates:
 
   ```bash
   bash .devcontainer/init-plugins.sh
@@ -97,7 +97,7 @@ Mark as executable: `chmod +x init-plugins.sh`
 
 #### Bundled plugins
 
-`init-plugins.sh` registers four marketplaces and installs the following plugins:
+`init-plugins.sh` registers five marketplaces and installs the following plugins:
 
 | Marketplace | Plugin | Purpose |
 |---|---|---|
@@ -111,6 +111,7 @@ Mark as executable: `chmod +x init-plugins.sh`
 | `anthropics/claude-plugins-official` | `claude-md-management` | Audits and updates CLAUDE.md |
 | `anthropics/claude-plugins-official` | `claude-code-setup` | Settings, permissions, automation helpers |
 | `anthropics/claude-plugins-official` | `posthog` | PostHog product-analytics & LLM-traces skills |
+| `cloudflare/skills` | `cloudflare` | Cloudflare skills and MCP server |
 | `umputun/ralphex` | `ralphex` | Autonomous plan execution |
 | `GoogleChrome/modern-web-guidance` | `modern-web-guidance` | Accessible, performant, secure modern web patterns ([docs](https://developer.chrome.com/docs/modern-web-guidance)) |
 | `AgriciDaniel/claude-seo` | `claude-seo` | SEO analysis toolkit — technical SEO, schema, E-E-A-T, GEO/AEO, Google APIs ([repo](https://github.com/AgriciDaniel/claude-seo)) |