diff --git a/ansible/upgrade.sh b/ansible/upgrade.sh
new file mode 100755
index 0000000..8e78764
--- /dev/null
+++ b/ansible/upgrade.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Wrapper for upgrade.yml.
+# Usage: ./upgrade.sh [--reboot] [ansible-playbook args, e.g. --limit dm-edworth --ask-become-pass]
+set -euo pipefail
+cd "$(dirname "$0")"
+
+EXTRA=()
+if [[ "${1:-}" == "--reboot" ]]; then
+  EXTRA=(-e reboot=true)
+  shift
+fi
+
+exec ansible-playbook upgrade.yml "${EXTRA[@]}" "$@"
diff --git a/ansible/upgrade.yml b/ansible/upgrade.yml
new file mode 100644
index 0000000..120f868
--- /dev/null
+++ b/ansible/upgrade.yml
@@ -0,0 +1,29 @@
+---
+# apt update + dist-upgrade on meshcore nodes, one host at a time.
+#   ansible-playbook upgrade.yml [--limit dm-edworth]
+#   ansible-playbook upgrade.yml -e reboot=true   # reboot only nodes that need it
+- name: Upgrade packages
+  hosts: meshcore
+  become: true
+  serial: 1
+  vars:
+    reboot: false
+  tasks:
+    - name: apt update and dist-upgrade
+      ansible.builtin.apt:
+        update_cache: true
+        upgrade: dist
+        autoremove: true
+
+    - name: Check whether a reboot is required
+      ansible.builtin.stat:
+        path: /var/run/reboot-required
+      register: reboot_required
+
+    - name: Report reboot status
+      ansible.builtin.debug:
+        msg: "{{ inventory_hostname }}: reboot {{ 'required' if reboot_required.stat.exists else 'not required' }}"
+
+    - name: Reboot if required
+      ansible.builtin.reboot:
+      when: reboot | bool and reboot_required.stat.exists