diff --git a/.SRCINFO b/.SRCINFO
index 71f7ee6..515b2e6 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = grok-bot-bin
 	pkgdesc = Grok Bot desktop agent (official .deb repackaged)
 	pkgver = 0.35.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://cursor.com/download/bot
 	arch = x86_64
 	license = LicenseRef-proprietary
@@ -30,6 +30,6 @@ pkgbase = grok-bot-bin
 	source = grok-bot-launch.sh
 	noextract = grok-bot_0.35.0_amd64.deb
 	sha256sums = ed254e819d0f0419a1df9771009363074f65f80d8175d2ee0fc62900087ebd99
-	sha256sums = 886c8b55eb44d2f7812be50dcc1571907dc2d7e755171e67e916f497634f09eb
+	sha256sums = 1c5a3599db15816caa839fc9e088ba9798757e44fec89c066ef5f6f3c0972aee
 
 pkgname = grok-bot-bin
diff --git a/PKGBUILD b/PKGBUILD
index ccbb92c..5811b17 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -10,7 +10,7 @@
 pkgname=grok-bot-bin
 pkgver=0.35.0
 _commit=1c5a6ceb364c4dd53f0069f72cc4239220ed471e
-pkgrel=1
+pkgrel=2
 pkgdesc="Grok Bot desktop agent (official .deb repackaged)"
 arch=('x86_64')
 url="https://cursor.com/download/bot"
@@ -44,7 +44,7 @@ source=(
 noextract=("grok-bot_${pkgver}_amd64.deb")
 sha256sums=(
   'ed254e819d0f0419a1df9771009363074f65f80d8175d2ee0fc62900087ebd99'
-  '886c8b55eb44d2f7812be50dcc1571907dc2d7e755171e67e916f497634f09eb'
+  '1c5a3599db15816caa839fc9e088ba9798757e44fec89c066ef5f6f3c0972aee'
 )
 
 package() {
@@ -56,6 +56,14 @@ package() {
   # Keep provides(sand) on PATH; both names run the same shim.
   ln -sf grok-bot "$pkgdir/usr/bin/sand"
 
+  # Always point the menu entry at the PATH shim. Upstream .desktop has used
+  # Exec="/opt/Grok Bot/grok-bot" (0.30) which bypasses auto-update; rewrite
+  # every build so a future /opt regression cannot ship again.
+  if [[ -f "$pkgdir/usr/share/applications/grok-bot.desktop" ]]; then
+    sed -i 's|^Exec=.*|Exec=grok-bot %U|' \
+      "$pkgdir/usr/share/applications/grok-bot.desktop"
+  fi
+
   # Path contains a space, so Chromium cannot use the SUID sandbox.
   # Arch/CachyOS kernels have user namespaces; keep chrome-sandbox non-setuid.
   if [[ -f "$pkgdir/opt/Grok Bot/chrome-sandbox" ]]; then
diff --git a/README.md b/README.md
index 75f6004..f9a646f 100644
--- a/README.md
+++ b/README.md
@@ -58,5 +58,6 @@ Scheduled Gitea Actions will do the same and build a release package.
 ## Notes
 
 - `/usr/bin/grok-bot` (and `sand`) is a launch shim: unless `GROK_BOT_NO_UPDATE=1`, it checks the latest Gitea release and may `pacman -U` a newer `.pkg.tar.zst` before exec'ing `/opt/Grok Bot/…`. Network/API failures still launch the installed binary.
+- If the app menu still launches an old binary without updating, run `/usr/bin/grok-bot` once from a terminal, or `sudo pacman -U` the newer `.pkg.tar.zst` from Releases — the menu must call the PATH shim, not `/opt/Grok Bot/…`.
 - Upstream Linux builds still have no in-app updater for the Electron app itself; `scripts/update.sh` bumps the PKGBUILD from Cursor's feed when packaging a new upstream version.
 - `chrome-sandbox` is left non-setuid because the install path contains a space; user namespaces cover sandboxing on CachyOS.
diff --git a/grok-bot-launch.sh b/grok-bot-launch.sh
index 71a1716..8eb6e5a 100755
--- a/grok-bot-launch.sh
+++ b/grok-bot-launch.sh
@@ -53,6 +53,7 @@ _maybe_update() {
   # Prefer passwordless sudo; fall back to interactive sudo. Fail soft either way.
   if ! sudo -n pacman -U --noconfirm "$pkg" 2>/dev/null; then
     if ! sudo pacman -U --noconfirm "$pkg"; then
+      echo "grok-bot: need sudo to auto-update; run: sudo pacman -U <pkg> or launch /usr/bin/grok-bot from a terminal" >&2
       echo "grok-bot: pacman -U failed; launching installed version" >&2
       return 0
     fi