diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/assets/dd-karpenter-fargate.yaml b/cmd/kubectl-datadog/autoscaling/cluster/apply/assets/dd-karpenter-fargate.yaml
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/assets/dd-karpenter-fargate.yaml
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/assets/dd-karpenter-fargate.yaml
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/assets/dd-karpenter.yaml b/cmd/kubectl-datadog/autoscaling/cluster/apply/assets/dd-karpenter.yaml
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/assets/dd-karpenter.yaml
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/assets/dd-karpenter.yaml
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/assets/karpenter.yaml b/cmd/kubectl-datadog/autoscaling/cluster/apply/assets/karpenter.yaml
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/assets/karpenter.yaml
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/assets/karpenter.yaml
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/create_karpenter_resources.go b/cmd/kubectl-datadog/autoscaling/cluster/apply/create_karpenter_resources.go
similarity index 98%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/create_karpenter_resources.go
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/create_karpenter_resources.go
index abb8505ce7..2438362830 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/create_karpenter_resources.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/apply/create_karpenter_resources.go
@@ -1,4 +1,4 @@
-package install
+package apply
 
 import "fmt"
 
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/create_karpenter_resources_test.go b/cmd/kubectl-datadog/autoscaling/cluster/apply/create_karpenter_resources_test.go
similarity index 99%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/create_karpenter_resources_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/create_karpenter_resources_test.go
index 0a95cdbf96..54cb50439b 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/create_karpenter_resources_test.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/apply/create_karpenter_resources_test.go
@@ -1,4 +1,4 @@
-package install
+package apply
 
 import (
 	"testing"
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/inference_method.go b/cmd/kubectl-datadog/autoscaling/cluster/apply/inference_method.go
similarity index 98%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/inference_method.go
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/inference_method.go
index cff35f9412..0a26feee0b 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/inference_method.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/apply/inference_method.go
@@ -1,4 +1,4 @@
-package install
+package apply
 
 import "fmt"
 
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/inference_method_test.go b/cmd/kubectl-datadog/autoscaling/cluster/apply/inference_method_test.go
similarity index 99%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/inference_method_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/inference_method_test.go
index 46b20bd0fa..e958b2ba49 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/inference_method_test.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/apply/inference_method_test.go
@@ -1,4 +1,4 @@
-package install
+package apply
 
 import (
 	"testing"
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/install_mode.go b/cmd/kubectl-datadog/autoscaling/cluster/apply/install_mode.go
similarity index 98%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/install_mode.go
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/install_mode.go
index 47239c3581..1b87047b7c 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/install_mode.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/apply/install_mode.go
@@ -1,4 +1,4 @@
-package install
+package apply
 
 import "fmt"
 
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/install_mode_test.go b/cmd/kubectl-datadog/autoscaling/cluster/apply/install_mode_test.go
similarity index 98%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/install_mode_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/install_mode_test.go
index acde9f6e62..e57fb4c129 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/install_mode_test.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/apply/install_mode_test.go
@@ -1,4 +1,4 @@
-package install
+package apply
 
 import (
 	"testing"
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/steps.go b/cmd/kubectl-datadog/autoscaling/cluster/apply/run.go
similarity index 66%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/steps.go
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/run.go
index 4dfe380465..1d3e7b3db0 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/steps.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/apply/run.go
@@ -1,24 +1,27 @@
-package install
+// Package apply contains the convergence logic shared between the `install`
+// and `update` cobra commands. Both subcommands ultimately call Run with a
+// RunOptions describing the desired Karpenter deployment; Run creates or
+// updates the CloudFormation stacks, the Helm release, the aws-auth role, the
+// optional EC2NodeClass/NodePool resources and the cluster-info ConfigMap.
+package apply
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"log"
 	"net/url"
-	"os/signal"
 	"slices"
 	"strconv"
 	"strings"
-	"syscall"
 
 	awssdk "github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/eks"
 	"github.com/davecgh/go-spew/spew"
 	"github.com/fatih/color"
 	"github.com/pkg/browser"
-	"github.com/spf13/cobra"
 	"helm.sh/helm/v3/pkg/registry"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+	"k8s.io/client-go/kubernetes"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
@@ -27,8 +30,8 @@ import (
 	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/clusterinfo"
 	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/display"
 	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/helm"
-	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/install/guess"
-	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/install/k8s"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/guess"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/k8s"
 	"github.com/DataDog/datadog-operator/pkg/version"
 
 	_ "embed"
@@ -49,117 +52,149 @@ var (
 	DdKarpenterFargateCfn string
 )
 
-// installModeTagKey is the CloudFormation stack tag tracking the deployment's
-// install-mode. Stacks created before this tag was introduced are treated as
-// install-mode=existing-nodes.
-const installModeTagKey = "install-mode"
-
-func (o *options) run(cmd *cobra.Command) error {
-	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
-	defer stop()
-
-	log.SetOutput(cmd.OutOrStderr())
-	ctrl.SetLogger(zap.New(zap.UseDevMode(false), zap.WriteTo(cmd.ErrOrStderr())))
-
-	if clusterName == "" {
-		if name, err := clients.GetClusterNameFromKubeconfig(o.ConfigFlags); err != nil {
-			return err
-		} else if name != "" {
-			clusterName = name
-		} else {
-			return errors.New("cluster name must be specified either via --cluster-name or in the current kubeconfig context")
-		}
+// RunOptions captures every parameter that callers (the install and update
+// cobra commands) feed into Run.
+type RunOptions struct {
+	ClusterName              string
+	KarpenterNamespace       string
+	KarpenterVersion         string
+	InstallMode              InstallMode
+	FargateSubnets           []string
+	CreateKarpenterResources CreateKarpenterResources
+	InferenceMethod          InferenceMethod
+	Debug                    bool
+	// ActionLabel prefixes the opening "<label> Karpenter on cluster <c>."
+	// box. install passes "Installing", update passes "Updating".
+	ActionLabel string
+}
+
+// KarpenterStackName returns the name of the mode-independent CloudFormation
+// stack carrying the KarpenterNodeRole, controller policy, SQS queue and
+// EventBridge rules.
+func KarpenterStackName(clusterName string) string {
+	return "dd-karpenter-" + clusterName + "-karpenter"
+}
+
+// DDKarpenterStackName returns the name of the mode-dependent CloudFormation
+// stack: aws-auth role, optional Fargate profile, IRSA role, etc.
+func DDKarpenterStackName(clusterName string) string {
+	return "dd-karpenter-" + clusterName + "-dd-karpenter"
+}
+
+// InstallModeTagKey is the CloudFormation stack tag tracking the deployment's
+// install-mode. Stacks created before this tag was introduced have no tag and
+// are treated as install-mode=existing-nodes.
+const InstallModeTagKey = "install-mode"
+
+// DetectedInstallMode reads the install-mode tag from a CFN stack. Stacks
+// created before this tag was introduced have no tag and default to
+// existing-nodes for backward compatibility.
+func DetectedInstallMode(stack *aws.Stack) InstallMode {
+	if stack == nil {
+		return ""
+	}
+	if tag, ok := stack.TagMap()[InstallModeTagKey]; ok && tag != "" {
+		return InstallMode(tag)
 	}
+	return InstallModeExistingNodes
+}
+
+// Run converges the cluster towards the Karpenter deployment described by
+// opts. It is idempotent: calling it twice with the same opts is a no-op on
+// the second run.
+func Run(ctx context.Context, streams genericclioptions.IOStreams, configFlags *genericclioptions.ConfigFlags, clientset *kubernetes.Clientset, opts RunOptions) error {
+	log.SetOutput(streams.ErrOut)
+	ctrl.SetLogger(zap.New(zap.UseDevMode(false), zap.WriteTo(streams.ErrOut)))
 
-	if autoModeEnabled, err := guess.IsEKSAutoModeEnabled(o.DiscoveryClient); err != nil {
+	if autoModeEnabled, err := guess.IsEKSAutoModeEnabled(clientset.Discovery()); err != nil {
 		return fmt.Errorf("failed to check for EKS auto-mode: %w", err)
 	} else if autoModeEnabled {
-		return displayEKSAutoModeMessage(cmd, clusterName)
+		return displayEKSAutoModeMessage(streams, opts.ClusterName)
 	}
 
-	k, err := guess.FindKarpenterInstallation(ctx, o.Clientset)
+	k, err := guess.FindKarpenterInstallation(ctx, clientset)
 	if err != nil {
 		return fmt.Errorf("failed to check for an existing Karpenter installation: %w", err)
 	}
-	if k != nil && (!k.IsOwn() || k.Namespace != karpenterNamespace) {
-		return displayForeignKarpenterMessage(cmd, clusterName, k)
+	if k != nil && (!k.IsOwn() || k.Namespace != opts.KarpenterNamespace) {
+		return displayForeignKarpenterMessage(streams, opts.ClusterName, k)
 	}
 
-	display.PrintBox(cmd.OutOrStdout(), "Installing Karpenter on cluster "+clusterName+".")
+	display.PrintBox(streams.Out, opts.ActionLabel+" Karpenter on cluster "+opts.ClusterName+".")
 
-	cli, err := clients.Build(ctx, o.ConfigFlags, o.Clientset)
+	cli, err := clients.Build(ctx, configFlags, clientset)
 	if err != nil {
 		return fmt.Errorf("failed to build clients: %w", err)
 	}
 
-	if err = clients.ValidateAWSAccountConsistency(ctx, cli, clusterName, o.ConfigFlags); err != nil {
+	if err = clients.ValidateAWSAccountConsistency(ctx, cli, opts.ClusterName, configFlags); err != nil {
 		return err
 	}
 
-	irsaRoleArn, err := createCloudFormationStacks(ctx, cli, clusterName, karpenterNamespace, installMode, fargateSubnets)
+	irsaRoleArn, err := createCloudFormationStacks(ctx, cli, opts)
 	if err != nil {
 		return err
 	}
 
-	if err = updateAwsAuthConfigMap(ctx, cli, clusterName); err != nil {
+	if err = updateAwsAuthConfigMap(ctx, cli, opts.ClusterName); err != nil {
 		return err
 	}
 
-	if err = o.installHelmChart(ctx, clusterName, karpenterNamespace, karpenterVersion, debug, installMode, irsaRoleArn); err != nil {
+	if err = installHelmChart(ctx, configFlags, opts, irsaRoleArn); err != nil {
 		return err
 	}
 
-	if err = createNodePoolResources(ctx, cmd, cli, clusterName, createKarpenterResources, inferenceMethod, debug); err != nil {
+	if err = createNodePoolResources(ctx, streams, cli, opts); err != nil {
 		return err
 	}
 
-	if err = recordClusterInfo(ctx, cli, clusterName, karpenterNamespace); err != nil {
+	if err = recordClusterInfo(ctx, cli, opts.ClusterName, opts.KarpenterNamespace); err != nil {
 		log.Printf("Warning: %v", err)
 	}
 
-	return displaySuccessMessage(cmd, clusterName, createKarpenterResources)
+	return displaySuccessMessage(streams, opts.ClusterName, opts.CreateKarpenterResources)
 }
 
 // createCloudFormationStacks creates (or updates) the CFN stacks required for
 // the selected install mode. Returns the IRSA role ARN when the mode is
 // fargate; empty string otherwise.
-func createCloudFormationStacks(ctx context.Context, cli *clients.Clients, clusterName, karpenterNamespace string, mode InstallMode, fargateSubnetsOverride []string) (string, error) {
+func createCloudFormationStacks(ctx context.Context, cli *clients.Clients, opts RunOptions) (string, error) {
 	// The first stack (karpenter.yaml) is mode-independent — its resources
 	// (KarpenterNodeRole, KarpenterControllerPolicy, SQS, EventBridge) are
 	// identical in both modes, so no guardrail or install-mode tag is needed.
-	karpenterStackName := "dd-karpenter-" + clusterName + "-karpenter"
+	karpenterStackName := KarpenterStackName(opts.ClusterName)
 	if err := aws.CreateOrUpdateStack(ctx, cli.CloudFormation, karpenterStackName, KarpenterCfn, map[string]string{
-		"ClusterName": clusterName,
+		"ClusterName": opts.ClusterName,
 	}, nil); err != nil {
 		return "", fmt.Errorf("failed to create or update Cloud Formation stack: %w", err)
 	}
 
-	describeOut, err := cli.EKS.DescribeCluster(ctx, &eks.DescribeClusterInput{Name: awssdk.String(clusterName)})
+	describeOut, err := cli.EKS.DescribeCluster(ctx, &eks.DescribeClusterInput{Name: awssdk.String(opts.ClusterName)})
 	if err != nil {
-		return "", fmt.Errorf("failed to describe cluster %s: %w", clusterName, err)
+		return "", fmt.Errorf("failed to describe cluster %s: %w", opts.ClusterName, err)
 	}
 	cluster := describeOut.Cluster
 	supportsAPIAuth := guess.SupportsAPIAuthenticationMode(cluster)
 
-	ddStackName := "dd-karpenter-" + clusterName + "-dd-karpenter"
+	ddStackName := DDKarpenterStackName(opts.ClusterName)
 	ddStack, err := aws.GetStack(ctx, cli.CloudFormation, ddStackName)
 	if err != nil {
 		return "", err
 	}
-	if err := checkInstallModeTag(ddStack, mode); err != nil {
+	if err := checkInstallModeTag(ddStack, opts.InstallMode); err != nil {
 		return "", err
 	}
-	modeTags := map[string]string{installModeTagKey: string(mode)}
+	modeTags := map[string]string{InstallModeTagKey: string(opts.InstallMode)}
 
-	switch mode {
+	switch opts.InstallMode {
 	case InstallModeExistingNodes:
-		isUnmanagedEKSPIAInstalled, err := guess.IsThereUnmanagedEKSPodIdentityAgentInstalled(ctx, cli.EKS, clusterName)
+		isUnmanagedEKSPIAInstalled, err := guess.IsThereUnmanagedEKSPodIdentityAgentInstalled(ctx, cli.EKS, opts.ClusterName)
 		if err != nil {
 			return "", fmt.Errorf("failed to check if EKS pod identity agent is installed: %w", err)
 		}
 		if err := aws.CreateOrUpdateStackWithExisting(ctx, cli.CloudFormation, ddStackName, DdKarpenterCfn, map[string]string{
-			"ClusterName":            clusterName,
-			"KarpenterNamespace":     karpenterNamespace,
+			"ClusterName":            opts.ClusterName,
+			"KarpenterNamespace":     opts.KarpenterNamespace,
 			"DeployPodIdentityAddon": strconv.FormatBool(!isUnmanagedEKSPIAInstalled),
 			"DeployNodeAccessEntry":  strconv.FormatBool(supportsAPIAuth),
 		}, modeTags, ddStack); err != nil {
@@ -177,7 +212,7 @@ func createCloudFormationStacks(ctx context.Context, cli *clients.Clients, clust
 			return "", fmt.Errorf("failed to ensure OIDC provider: %w", err)
 		}
 
-		subnets := fargateSubnetsOverride
+		subnets := opts.FargateSubnets
 		if len(subnets) == 0 {
 			subnets, err = guess.GetClusterPrivateSubnets(ctx, cli.EC2, cluster)
 			if err != nil {
@@ -189,13 +224,13 @@ func createCloudFormationStacks(ctx context.Context, cli *clients.Clients, clust
 		// the immutability check order-independent.
 		slices.Sort(subnets)
 
-		if err = checkFargateStackImmutability(ddStack, karpenterNamespace, subnets); err != nil {
+		if err = checkFargateStackImmutability(ddStack, opts.KarpenterNamespace, subnets); err != nil {
 			return "", err
 		}
 
 		if err = aws.CreateOrUpdateStackWithExisting(ctx, cli.CloudFormation, ddStackName, DdKarpenterFargateCfn, map[string]string{
-			"ClusterName":           clusterName,
-			"KarpenterNamespace":    karpenterNamespace,
+			"ClusterName":           opts.ClusterName,
+			"KarpenterNamespace":    opts.KarpenterNamespace,
 			"OIDCProviderArn":       oidcArn,
 			"OIDCProviderURL":       strings.TrimPrefix(issuerURL, "https://"),
 			"FargateSubnets":        strings.Join(subnets, ","),
@@ -219,7 +254,7 @@ func createCloudFormationStacks(ctx context.Context, cli *clients.Clients, clust
 		return irsaRoleArn, nil
 
 	default:
-		return "", fmt.Errorf("unsupported install mode %q", mode)
+		return "", fmt.Errorf("unsupported install mode %q", opts.InstallMode)
 	}
 }
 
@@ -230,10 +265,7 @@ func checkInstallModeTag(stack *aws.Stack, expected InstallMode) error {
 	if stack == nil {
 		return nil // fresh install
 	}
-	existing := InstallModeExistingNodes
-	if tag, ok := stack.TagMap()[installModeTagKey]; ok && tag != "" {
-		existing = InstallMode(tag)
-	}
+	existing := DetectedInstallMode(stack)
 	if existing != expected {
 		return fmt.Errorf("stack %s was created with --install-mode=%s; run 'kubectl datadog autoscaling cluster uninstall' first to switch to --install-mode=%s", awssdk.ToString(stack.StackName), existing, expected)
 	}
@@ -289,21 +321,21 @@ func updateAwsAuthConfigMap(ctx context.Context, cli *clients.Clients, clusterNa
 	return nil
 }
 
-func (o *options) installHelmChart(ctx context.Context, clusterName, karpenterNamespace, karpenterVersion string, debug bool, mode InstallMode, irsaRoleArn string) error {
-	actionConfig, err := helm.NewActionConfig(o.ConfigFlags, karpenterNamespace)
+func installHelmChart(ctx context.Context, configFlags *genericclioptions.ConfigFlags, opts RunOptions, irsaRoleArn string) error {
+	actionConfig, err := helm.NewActionConfig(configFlags, opts.KarpenterNamespace)
 	if err != nil {
 		return err
 	}
 
 	if actionConfig.RegistryClient, err = registry.NewClient(
-		registry.ClientOptDebug(debug),
+		registry.ClientOptDebug(opts.Debug),
 		registry.ClientOptEnableCache(true),
 		registry.ClientOptWriter(log.Writer()),
 	); err != nil {
 		return fmt.Errorf("failed to create registry client: %w", err)
 	}
 
-	if err = helm.CreateOrUpgrade(ctx, actionConfig, "karpenter", karpenterNamespace, karpenterOCIRegistry, karpenterVersion, karpenterHelmValues(clusterName, mode, irsaRoleArn)); err != nil {
+	if err = helm.CreateOrUpgrade(ctx, actionConfig, "karpenter", opts.KarpenterNamespace, karpenterOCIRegistry, opts.KarpenterVersion, karpenterHelmValues(opts.ClusterName, opts.InstallMode, irsaRoleArn)); err != nil {
 		return fmt.Errorf("failed to create or update Helm release: %w", err)
 	}
 
@@ -362,15 +394,15 @@ func karpenterHelmValues(clusterName string, mode InstallMode, irsaRoleArn strin
 	return values
 }
 
-func createNodePoolResources(ctx context.Context, cmd *cobra.Command, cli *clients.Clients, clusterName string, createResources CreateKarpenterResources, inferenceMethod InferenceMethod, debug bool) error {
-	if createResources == CreateKarpenterResourcesNone {
+func createNodePoolResources(ctx context.Context, streams genericclioptions.IOStreams, cli *clients.Clients, opts RunOptions) error {
+	if opts.CreateKarpenterResources == CreateKarpenterResourcesNone {
 		return nil
 	}
 
 	var nodePoolsSet *guess.NodePoolsSet
 	var err error
 
-	switch inferenceMethod {
+	switch opts.InferenceMethod {
 	case InferenceMethodNodes:
 		nodePoolsSet, err = guess.GetNodesProperties(ctx, cli.K8sClientset, cli.EC2)
 		if err != nil {
@@ -378,25 +410,25 @@ func createNodePoolResources(ctx context.Context, cmd *cobra.Command, cli *clien
 		}
 
 	case InferenceMethodNodeGroups:
-		nodePoolsSet, err = guess.GetNodeGroupsProperties(ctx, cli.EKS, cli.EC2, clusterName)
+		nodePoolsSet, err = guess.GetNodeGroupsProperties(ctx, cli.EKS, cli.EC2, opts.ClusterName)
 		if err != nil {
 			return fmt.Errorf("failed to gather node groups properties: %w", err)
 		}
 	}
 
-	if debug {
-		cmd.Printf("Creating the following resources:\n %s\n", spew.Sdump(nodePoolsSet))
+	if opts.Debug {
+		fmt.Fprintf(streams.Out, "Creating the following resources:\n %s\n", spew.Sdump(nodePoolsSet))
 	}
 
-	if createResources == CreateKarpenterResourcesEC2NodeClass || createResources == CreateKarpenterResourcesAll {
+	if opts.CreateKarpenterResources == CreateKarpenterResourcesEC2NodeClass || opts.CreateKarpenterResources == CreateKarpenterResourcesAll {
 		for _, nc := range nodePoolsSet.GetEC2NodeClasses() {
-			if err = k8s.CreateOrUpdateEC2NodeClass(ctx, cli.K8sClient, clusterName, nc); err != nil {
+			if err = k8s.CreateOrUpdateEC2NodeClass(ctx, cli.K8sClient, opts.ClusterName, nc); err != nil {
 				return fmt.Errorf("failed to create or update EC2NodeClass %s: %w", nc.GetName(), err)
 			}
 		}
 	}
 
-	if createResources == CreateKarpenterResourcesAll {
+	if opts.CreateKarpenterResources == CreateKarpenterResourcesAll {
 		for _, np := range nodePoolsSet.GetNodePools() {
 			if err = k8s.CreateOrUpdateNodePool(ctx, cli.K8sClient, np); err != nil {
 				return fmt.Errorf("failed to create or update NodePool %s: %w", np.GetName(), err)
@@ -422,7 +454,7 @@ func recordClusterInfo(ctx context.Context, cli *clients.Clients, clusterName, n
 	return nil
 }
 
-func openAutoscalingSettingsURL(cmd *cobra.Command, clusterName string) string {
+func openAutoscalingSettingsURL(streams genericclioptions.IOStreams, clusterName string) string {
 	autoscalingSettingsURL := (&url.URL{
 		Scheme:   "https",
 		Host:     "app.datadoghq.com",
@@ -430,8 +462,8 @@ func openAutoscalingSettingsURL(cmd *cobra.Command, clusterName string) string {
 		RawQuery: url.Values{"query": []string{"kube_cluster_name:" + clusterName}}.Encode(),
 	}).String()
 
-	browser.Stdout = cmd.OutOrStdout()
-	browser.Stderr = cmd.ErrOrStderr()
+	browser.Stdout = streams.Out
+	browser.Stderr = streams.ErrOut
 	if err := browser.OpenURL(autoscalingSettingsURL); err != nil {
 		log.Printf("Failed to open URL in browser: %v", err)
 	}
@@ -439,10 +471,10 @@ func openAutoscalingSettingsURL(cmd *cobra.Command, clusterName string) string {
 	return color.New(color.Bold, color.Underline, color.FgBlue).Sprint(autoscalingSettingsURL)
 }
 
-func displayEKSAutoModeMessage(cmd *cobra.Command, clusterName string) error {
-	coloredURL := openAutoscalingSettingsURL(cmd, clusterName)
+func displayEKSAutoModeMessage(streams genericclioptions.IOStreams, clusterName string) error {
+	coloredURL := openAutoscalingSettingsURL(streams, clusterName)
 
-	display.PrintBox(cmd.OutOrStdout(),
+	display.PrintBox(streams.Out,
 		"EKS auto-mode is already active on cluster "+clusterName+".",
 		"",
 		"Karpenter is built into EKS auto-mode",
@@ -456,10 +488,10 @@ func displayEKSAutoModeMessage(cmd *cobra.Command, clusterName string) error {
 	return nil
 }
 
-func displayForeignKarpenterMessage(cmd *cobra.Command, clusterName string, foreign *guess.KarpenterInstallation) error {
-	coloredURL := openAutoscalingSettingsURL(cmd, clusterName)
+func displayForeignKarpenterMessage(streams genericclioptions.IOStreams, clusterName string, foreign *guess.KarpenterInstallation) error {
+	coloredURL := openAutoscalingSettingsURL(streams, clusterName)
 
-	display.PrintBox(cmd.OutOrStdout(),
+	display.PrintBox(streams.Out,
 		"Karpenter is already installed on cluster "+clusterName+":",
 		"Deployment "+foreign.Namespace+"/"+foreign.Name+".",
 		"",
@@ -473,12 +505,12 @@ func displayForeignKarpenterMessage(cmd *cobra.Command, clusterName string, fore
 	return nil
 }
 
-func displaySuccessMessage(cmd *cobra.Command, clusterName string, createResources CreateKarpenterResources) error {
-	coloredURL := openAutoscalingSettingsURL(cmd, clusterName)
+func displaySuccessMessage(streams genericclioptions.IOStreams, clusterName string, createResources CreateKarpenterResources) error {
+	coloredURL := openAutoscalingSettingsURL(streams, clusterName)
 
 	switch createResources {
 	case CreateKarpenterResourcesNone:
-		display.PrintBox(cmd.OutOrStdout(),
+		display.PrintBox(streams.Out,
 			"✅ Datadog cluster autoscaling is partially configured.",
 			"",
 			"No Karpenter resources were created.",
@@ -489,7 +521,7 @@ func displaySuccessMessage(cmd *cobra.Command, clusterName string, createResourc
 			coloredURL,
 		)
 	case CreateKarpenterResourcesEC2NodeClass, CreateKarpenterResourcesAll:
-		display.PrintBox(cmd.OutOrStdout(),
+		display.PrintBox(streams.Out,
 			"✅ Datadog cluster autoscaling is now ready to be enabled.",
 			"",
 			"Navigate to the Autoscaling settings page",
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/steps_test.go b/cmd/kubectl-datadog/autoscaling/cluster/apply/run_test.go
similarity index 92%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/steps_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/apply/run_test.go
index 71b4551b4a..a3f94c88c0 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/steps_test.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/apply/run_test.go
@@ -1,14 +1,14 @@
-package install
+package apply
 
 import (
 	"bytes"
 	"testing"
 
-	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
 
-	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/install/guess"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/guess"
 )
 
 func TestKarpenterHelmValues(t *testing.T) {
@@ -50,12 +50,10 @@ func TestDisplayForeignKarpenterMessage(t *testing.T) {
 	t.Setenv("PATH", "")
 
 	out := &bytes.Buffer{}
-	cmd := &cobra.Command{}
-	cmd.SetOut(out)
-	cmd.SetErr(&bytes.Buffer{})
+	streams := genericclioptions.IOStreams{Out: out, ErrOut: &bytes.Buffer{}}
 
 	foreign := &guess.KarpenterInstallation{Namespace: "karpenter", Name: "karpenter"}
-	err := displayForeignKarpenterMessage(cmd, "my-cluster", foreign)
+	err := displayForeignKarpenterMessage(streams, "my-cluster", foreign)
 	require.NoError(t, err, "foreign Karpenter is a successful no-op, not an error")
 
 	rendered := out.String()
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/cluster.go b/cmd/kubectl-datadog/autoscaling/cluster/cluster.go
index ce16cfcf8d..b66e041d97 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/cluster.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/cluster.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/install"
 	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/uninstall"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/update"
 )
 
 // options provides information required by cluster command
@@ -33,6 +34,7 @@ func New(streams genericclioptions.IOStreams) *cobra.Command {
 
 	cmd.AddCommand(install.New(streams))
 	cmd.AddCommand(uninstall.New(streams))
+	cmd.AddCommand(update.New(streams))
 
 	o := newOptions(streams)
 	o.configFlags.AddFlags(cmd.Flags())
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/common/clients/clients.go b/cmd/kubectl-datadog/autoscaling/cluster/common/clients/clients.go
index bfd11280c2..ffa100e61b 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/common/clients/clients.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/common/clients/clients.go
@@ -31,7 +31,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
 	karpv1 "sigs.k8s.io/karpenter/pkg/apis/v1"
 
-	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/install/guess"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/guess"
 )
 
 // Clients holds all AWS and Kubernetes client instances needed for
@@ -142,6 +142,24 @@ func GetClusterNameFromKubeconfig(configFlags *genericclioptions.ConfigFlags) (s
 	return guess.GetClusterNameFromKubeconfig(kubeRawConfig, kubeContext), nil
 }
 
+// ResolveClusterName returns explicit when non-empty, otherwise infers the
+// cluster name from the kubeconfig context. Returns an error when neither
+// source provides a name so callers do not have to repeat the same fallback
+// boilerplate in every cobra command.
+func ResolveClusterName(configFlags *genericclioptions.ConfigFlags, explicit string) (string, error) {
+	if explicit != "" {
+		return explicit, nil
+	}
+	name, err := GetClusterNameFromKubeconfig(configFlags)
+	if err != nil {
+		return "", err
+	}
+	if name == "" {
+		return "", errors.New("cluster name must be specified either via --cluster-name or in the current kubeconfig context")
+	}
+	return name, nil
+}
+
 // getAccountIDFromKubeconfig attempts to extract the AWS account ID from the
 // kubeconfig context. Returns an empty string if the context is not an EKS ARN.
 func getAccountIDFromKubeconfig(configFlags *genericclioptions.ConfigFlags) (string, error) {
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/common/k8s/object.go b/cmd/kubectl-datadog/autoscaling/cluster/common/k8s/object.go
index 71a6a65729..d49efa395a 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/common/k8s/object.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/common/k8s/object.go
@@ -6,21 +6,30 @@ import (
 	"log"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/client-go/util/retry"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
+// CreateOrUpdate creates the object if missing, otherwise updates it. The
+// Update races against any controller actively reconciling the same resource
+// (Karpenter mutates its NodePool / EC2NodeClass when a NodeClaim status
+// changes), so an Update can fail with a Conflict whenever the controller has
+// bumped the resourceVersion since our Get. Re-fetch and retry on Conflict is
+// the standard k8s pattern.
 func CreateOrUpdate(ctx context.Context, cli client.Client, object client.Object) error {
-	resourceVersion, err := getResourceVersion(ctx, cli, object)
-	if err != nil {
-		return err
-	}
+	return retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		resourceVersion, err := getResourceVersion(ctx, cli, object)
+		if err != nil {
+			return err
+		}
 
-	if resourceVersion != "" {
-		object.SetResourceVersion(resourceVersion)
-		return update(ctx, cli, object)
-	} else {
-		return create(ctx, cli, object)
-	}
+		if resourceVersion != "" {
+			object.SetResourceVersion(resourceVersion)
+			return update(ctx, cli, object)
+		} else {
+			return create(ctx, cli, object)
+		}
+	})
 }
 
 func getResourceVersion(ctx context.Context, cli client.Client, object client.Object) (string, error) {
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/aws-auth.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/aws-auth.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/aws-auth.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/aws-auth.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/clusterauthmode.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/clusterauthmode.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/clusterauthmode.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/clusterauthmode.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/clustername.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/clustername.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/clustername.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/clustername.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/clustername_test.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/clustername_test.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/clustername_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/clustername_test.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/eksautomode.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/eksautomode.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/eksautomode.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/eksautomode.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/eksautomode_test.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/eksautomode_test.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/eksautomode_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/eksautomode_test.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/ekspodidentityagent.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/ekspodidentityagent.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/ekspodidentityagent.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/ekspodidentityagent.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/karpenter.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/karpenter.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/karpenter.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/karpenter.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/karpenter_test.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/karpenter_test.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/karpenter_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/karpenter_test.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/nodegroupproperties.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/nodegroupproperties.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/nodegroupproperties.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/nodegroupproperties.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/nodepoolsset.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/nodepoolsset.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/nodepoolsset.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/nodepoolsset.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/nodepoolsset_test.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/nodepoolsset_test.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/nodepoolsset_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/nodepoolsset_test.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/nodesproperties.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/nodesproperties.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/nodesproperties.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/nodesproperties.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/nodesproperties_test.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/nodesproperties_test.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/nodesproperties_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/nodesproperties_test.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/oidcprovider.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/oidcprovider.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/oidcprovider.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/oidcprovider.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/oidcprovider_test.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/oidcprovider_test.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/oidcprovider_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/oidcprovider_test.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/privatesubnets.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/privatesubnets.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/privatesubnets.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/privatesubnets.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/privatesubnets_test.go b/cmd/kubectl-datadog/autoscaling/cluster/guess/privatesubnets_test.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/privatesubnets_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/privatesubnets_test.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/guess/testdata/kubeconfig-eks.yaml b/cmd/kubectl-datadog/autoscaling/cluster/guess/testdata/kubeconfig-eks.yaml
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/guess/testdata/kubeconfig-eks.yaml
rename to cmd/kubectl-datadog/autoscaling/cluster/guess/testdata/kubeconfig-eks.yaml
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/install.go b/cmd/kubectl-datadog/autoscaling/cluster/install/install.go
index 9970202113..bfbc73cfe9 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/install.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/install/install.go
@@ -1,48 +1,57 @@
-// Package install provides functionality to install and configure Karpenter
-// autoscaling on EKS clusters, including CloudFormation stack creation,
-// Helm chart deployment, and resource configuration.
+// Package install provides the cobra command that installs Karpenter on an
+// EKS cluster. The command is a thin wrapper around the convergence logic in
+// the apply package — install binds CLI flags, validates them, and delegates
+// the actual deployment work to apply.Run.
 package install
 
 import (
+	"context"
 	"errors"
 	"fmt"
+	"os/signal"
 	"slices"
+	"syscall"
 
 	"github.com/spf13/cobra"
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/apply"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/clients"
 	"github.com/DataDog/datadog-operator/pkg/plugin/common"
 )
 
-var (
-	clusterName              string
-	karpenterNamespace       string
-	karpenterVersion         string
-	installMode              = InstallModeFargate
-	fargateSubnets           []string
-	createKarpenterResources = CreateKarpenterResourcesAll
-	inferenceMethod          = InferenceMethodNodeGroups
-	debug                    bool
-	installExample           = `
+var installExample = `
   # install autoscaling
   %[1]s install
 `
-)
 
 type options struct {
 	genericclioptions.IOStreams
 	common.Options
 	args []string
+
+	clusterName              string
+	karpenterNamespace       string
+	karpenterVersion         string
+	installMode              apply.InstallMode
+	fargateSubnets           []string
+	createKarpenterResources apply.CreateKarpenterResources
+	inferenceMethod          apply.InferenceMethod
+	debug                    bool
 }
 
 func newOptions(streams genericclioptions.IOStreams) *options {
 	o := &options{
-		IOStreams: streams,
+		IOStreams:                streams,
+		installMode:              apply.InstallModeFargate,
+		createKarpenterResources: apply.CreateKarpenterResourcesAll,
+		inferenceMethod:          apply.InferenceMethodNodeGroups,
 	}
 	o.SetConfigFlags()
 	return o
 }
 
+// New returns the cobra command for `kubectl datadog autoscaling cluster install`.
 func New(streams genericclioptions.IOStreams) *cobra.Command {
 	o := newOptions(streams)
 	cmd := &cobra.Command{
@@ -58,18 +67,18 @@ func New(streams genericclioptions.IOStreams) *cobra.Command {
 				return err
 			}
 
-			return o.run(c)
+			return o.run()
 		},
 	}
 
-	cmd.Flags().StringVar(&clusterName, "cluster-name", "", "Name of the EKS cluster")
-	cmd.Flags().StringVar(&karpenterNamespace, "karpenter-namespace", "dd-karpenter", "Name of the Kubernetes namespace to deploy Karpenter into")
-	cmd.Flags().StringVar(&karpenterVersion, "karpenter-version", "", "Version of Karpenter to install (default to latest)")
-	cmd.Flags().Var(&installMode, "install-mode", "How to run the Karpenter controller: fargate (on dedicated Fargate nodes, default) or existing-nodes (on existing cluster nodes)")
-	cmd.Flags().StringSliceVar(&fargateSubnets, "fargate-subnets", nil, "Override auto-discovery of private subnets for the Fargate profile (comma-separated subnet IDs). Only used when --install-mode=fargate.")
-	cmd.Flags().Var(&createKarpenterResources, "create-karpenter-resources", "Which Karpenter resources to create: none, ec2nodeclass, all (default: all)")
-	cmd.Flags().Var(&inferenceMethod, "inference-method", "Method to infer EC2NodeClass and NodePool properties: nodes, nodegroups")
-	cmd.Flags().BoolVar(&debug, "debug", false, "Enable debug logs")
+	cmd.Flags().StringVar(&o.clusterName, "cluster-name", "", "Name of the EKS cluster")
+	cmd.Flags().StringVar(&o.karpenterNamespace, "karpenter-namespace", "dd-karpenter", "Name of the Kubernetes namespace to deploy Karpenter into")
+	cmd.Flags().StringVar(&o.karpenterVersion, "karpenter-version", "", "Version of Karpenter to install (default to latest)")
+	cmd.Flags().Var(&o.installMode, "install-mode", "How to run the Karpenter controller: fargate (on dedicated Fargate nodes, default) or existing-nodes (on existing cluster nodes)")
+	cmd.Flags().StringSliceVar(&o.fargateSubnets, "fargate-subnets", nil, "Override auto-discovery of private subnets for the Fargate profile (comma-separated subnet IDs). Only used when --install-mode=fargate.")
+	cmd.Flags().Var(&o.createKarpenterResources, "create-karpenter-resources", "Which Karpenter resources to create: none, ec2nodeclass, all (default: all)")
+	cmd.Flags().Var(&o.inferenceMethod, "inference-method", "Method to infer EC2NodeClass and NodePool properties: nodes, nodegroups")
+	cmd.Flags().BoolVar(&o.debug, "debug", false, "Enable debug logs")
 
 	o.ConfigFlags.AddFlags(cmd.Flags())
 
@@ -88,21 +97,43 @@ func (o *options) validate() error {
 		return errors.New("no arguments are allowed")
 	}
 
-	if !slices.Contains([]InstallMode{InstallModeFargate, InstallModeExistingNodes}, installMode) {
+	if !slices.Contains([]apply.InstallMode{apply.InstallModeFargate, apply.InstallModeExistingNodes}, o.installMode) {
 		return errors.New("install-mode must be one of fargate or existing-nodes")
 	}
 
-	if len(fargateSubnets) > 0 && installMode != InstallModeFargate {
+	if len(o.fargateSubnets) > 0 && o.installMode != apply.InstallModeFargate {
 		return errors.New("--fargate-subnets can only be used with --install-mode=fargate")
 	}
 
-	if !slices.Contains([]CreateKarpenterResources{CreateKarpenterResourcesNone, CreateKarpenterResourcesEC2NodeClass, CreateKarpenterResourcesAll}, createKarpenterResources) {
+	if !slices.Contains([]apply.CreateKarpenterResources{apply.CreateKarpenterResourcesNone, apply.CreateKarpenterResourcesEC2NodeClass, apply.CreateKarpenterResourcesAll}, o.createKarpenterResources) {
 		return errors.New("create-karpenter-resources must be one of none, ec2nodeclass or all")
 	}
 
-	if !slices.Contains([]InferenceMethod{InferenceMethodNodes, InferenceMethodNodeGroups}, inferenceMethod) {
+	if !slices.Contains([]apply.InferenceMethod{apply.InferenceMethodNodes, apply.InferenceMethodNodeGroups}, o.inferenceMethod) {
 		return errors.New("inference-method must be one of nodes or nodegroups")
 	}
 
 	return nil
 }
+
+func (o *options) run() error {
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	clusterName, err := clients.ResolveClusterName(o.ConfigFlags, o.clusterName)
+	if err != nil {
+		return err
+	}
+
+	return apply.Run(ctx, o.IOStreams, o.ConfigFlags, o.Clientset, apply.RunOptions{
+		ClusterName:              clusterName,
+		KarpenterNamespace:       o.karpenterNamespace,
+		KarpenterVersion:         o.karpenterVersion,
+		InstallMode:              o.installMode,
+		FargateSubnets:           o.fargateSubnets,
+		CreateKarpenterResources: o.createKarpenterResources,
+		InferenceMethod:          o.inferenceMethod,
+		Debug:                    o.debug,
+		ActionLabel:              "Installing",
+	})
+}
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/install_test.go b/cmd/kubectl-datadog/autoscaling/cluster/install/install_test.go
index ca247fde41..5a38f8df75 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/install_test.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/install/install_test.go
@@ -4,134 +4,124 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/apply"
 )
 
 func TestValidate(t *testing.T) {
 	for _, tc := range []struct {
 		name                     string
 		args                     []string
-		installMode              InstallMode
+		installMode              apply.InstallMode
 		fargateSubnets           []string
-		createKarpenterResources CreateKarpenterResources
-		inferenceMethod          InferenceMethod
+		createKarpenterResources apply.CreateKarpenterResources
+		inferenceMethod          apply.InferenceMethod
 		expectError              bool
 		errorContains            string
 	}{
 		{
 			name:                     "Valid with nodes inference method",
 			args:                     []string{},
-			installMode:              InstallModeFargate,
-			createKarpenterResources: CreateKarpenterResourcesEC2NodeClass,
-			inferenceMethod:          InferenceMethodNodes,
+			installMode:              apply.InstallModeFargate,
+			createKarpenterResources: apply.CreateKarpenterResourcesEC2NodeClass,
+			inferenceMethod:          apply.InferenceMethodNodes,
 			expectError:              false,
 		},
 		{
 			name:                     "Valid with nodegroups inference method",
 			args:                     []string{},
-			installMode:              InstallModeFargate,
-			createKarpenterResources: CreateKarpenterResourcesEC2NodeClass,
-			inferenceMethod:          InferenceMethodNodeGroups,
+			installMode:              apply.InstallModeFargate,
+			createKarpenterResources: apply.CreateKarpenterResourcesEC2NodeClass,
+			inferenceMethod:          apply.InferenceMethodNodeGroups,
 			expectError:              false,
 		},
 		{
 			name:                     "Valid with create none",
 			args:                     []string{},
-			installMode:              InstallModeFargate,
-			createKarpenterResources: CreateKarpenterResourcesNone,
-			inferenceMethod:          InferenceMethodNodes,
+			installMode:              apply.InstallModeFargate,
+			createKarpenterResources: apply.CreateKarpenterResourcesNone,
+			inferenceMethod:          apply.InferenceMethodNodes,
 			expectError:              false,
 		},
 		{
 			name:                     "Valid with create all",
 			args:                     []string{},
-			installMode:              InstallModeFargate,
-			createKarpenterResources: CreateKarpenterResourcesAll,
-			inferenceMethod:          InferenceMethodNodes,
+			installMode:              apply.InstallModeFargate,
+			createKarpenterResources: apply.CreateKarpenterResourcesAll,
+			inferenceMethod:          apply.InferenceMethodNodes,
 			expectError:              false,
 		},
 		{
 			name:                     "Valid with existing-nodes mode",
 			args:                     []string{},
-			installMode:              InstallModeExistingNodes,
-			createKarpenterResources: CreateKarpenterResourcesAll,
-			inferenceMethod:          InferenceMethodNodes,
+			installMode:              apply.InstallModeExistingNodes,
+			createKarpenterResources: apply.CreateKarpenterResourcesAll,
+			inferenceMethod:          apply.InferenceMethodNodes,
 			expectError:              false,
 		},
 		{
 			name:                     "Valid with fargate-subnets in fargate mode",
 			args:                     []string{},
-			installMode:              InstallModeFargate,
+			installMode:              apply.InstallModeFargate,
 			fargateSubnets:           []string{"subnet-abc", "subnet-def"},
-			createKarpenterResources: CreateKarpenterResourcesAll,
-			inferenceMethod:          InferenceMethodNodes,
+			createKarpenterResources: apply.CreateKarpenterResourcesAll,
+			inferenceMethod:          apply.InferenceMethodNodes,
 			expectError:              false,
 		},
 		{
 			name:                     "Invalid with arguments",
 			args:                     []string{"arg1"},
-			installMode:              InstallModeFargate,
-			createKarpenterResources: CreateKarpenterResourcesEC2NodeClass,
-			inferenceMethod:          InferenceMethodNodes,
+			installMode:              apply.InstallModeFargate,
+			createKarpenterResources: apply.CreateKarpenterResourcesEC2NodeClass,
+			inferenceMethod:          apply.InferenceMethodNodes,
 			expectError:              true,
 			errorContains:            "no arguments are allowed",
 		},
 		{
 			name:                     "Invalid with invalid inference method",
 			args:                     []string{},
-			installMode:              InstallModeFargate,
-			createKarpenterResources: CreateKarpenterResourcesEC2NodeClass,
-			inferenceMethod:          InferenceMethod("invalid"),
+			installMode:              apply.InstallModeFargate,
+			createKarpenterResources: apply.CreateKarpenterResourcesEC2NodeClass,
+			inferenceMethod:          apply.InferenceMethod("invalid"),
 			expectError:              true,
 			errorContains:            "inference-method must be one of nodes or nodegroups",
 		},
 		{
 			name:                     "Invalid with invalid create resources",
 			args:                     []string{},
-			installMode:              InstallModeFargate,
-			createKarpenterResources: CreateKarpenterResources("invalid"),
-			inferenceMethod:          InferenceMethodNodes,
+			installMode:              apply.InstallModeFargate,
+			createKarpenterResources: apply.CreateKarpenterResources("invalid"),
+			inferenceMethod:          apply.InferenceMethodNodes,
 			expectError:              true,
 			errorContains:            "create-karpenter-resources must be one of none, ec2nodeclass or all",
 		},
 		{
 			name:                     "Invalid with invalid install mode",
 			args:                     []string{},
-			installMode:              InstallMode("invalid"),
-			createKarpenterResources: CreateKarpenterResourcesAll,
-			inferenceMethod:          InferenceMethodNodes,
+			installMode:              apply.InstallMode("invalid"),
+			createKarpenterResources: apply.CreateKarpenterResourcesAll,
+			inferenceMethod:          apply.InferenceMethodNodes,
 			expectError:              true,
 			errorContains:            "install-mode must be one of fargate or existing-nodes",
 		},
 		{
 			name:                     "Invalid fargate-subnets with existing-nodes mode",
 			args:                     []string{},
-			installMode:              InstallModeExistingNodes,
+			installMode:              apply.InstallModeExistingNodes,
 			fargateSubnets:           []string{"subnet-abc"},
-			createKarpenterResources: CreateKarpenterResourcesAll,
-			inferenceMethod:          InferenceMethodNodes,
+			createKarpenterResources: apply.CreateKarpenterResourcesAll,
+			inferenceMethod:          apply.InferenceMethodNodes,
 			expectError:              true,
 			errorContains:            "--fargate-subnets can only be used with --install-mode=fargate",
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			// Save and restore the global variables
-			oldMode := installMode
-			oldSubnets := fargateSubnets
-			oldCreate := createKarpenterResources
-			oldMethod := inferenceMethod
-			installMode = tc.installMode
-			fargateSubnets = tc.fargateSubnets
-			createKarpenterResources = tc.createKarpenterResources
-			inferenceMethod = tc.inferenceMethod
-			defer func() {
-				installMode = oldMode
-				fargateSubnets = oldSubnets
-				createKarpenterResources = oldCreate
-				inferenceMethod = oldMethod
-			}()
-
 			o := &options{
-				args: tc.args,
+				args:                     tc.args,
+				installMode:              tc.installMode,
+				fargateSubnets:           tc.fargateSubnets,
+				createKarpenterResources: tc.createKarpenterResources,
+				inferenceMethod:          tc.inferenceMethod,
 			}
 
 			err := o.validate()
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/k8s/ec2nodeclass.go b/cmd/kubectl-datadog/autoscaling/cluster/k8s/ec2nodeclass.go
similarity index 99%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/k8s/ec2nodeclass.go
rename to cmd/kubectl-datadog/autoscaling/cluster/k8s/ec2nodeclass.go
index 5cc6eccd2b..24b75d3932 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/k8s/ec2nodeclass.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/k8s/ec2nodeclass.go
@@ -12,7 +12,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	commonk8s "github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/k8s"
-	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/install/guess"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/guess"
 	"github.com/DataDog/datadog-operator/pkg/version"
 )
 
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/k8s/ec2nodeclass_test.go b/cmd/kubectl-datadog/autoscaling/cluster/k8s/ec2nodeclass_test.go
similarity index 100%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/k8s/ec2nodeclass_test.go
rename to cmd/kubectl-datadog/autoscaling/cluster/k8s/ec2nodeclass_test.go
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/install/k8s/nodepool.go b/cmd/kubectl-datadog/autoscaling/cluster/k8s/nodepool.go
similarity index 98%
rename from cmd/kubectl-datadog/autoscaling/cluster/install/k8s/nodepool.go
rename to cmd/kubectl-datadog/autoscaling/cluster/k8s/nodepool.go
index ba74e5c256..fb86075498 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/install/k8s/nodepool.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/k8s/nodepool.go
@@ -9,7 +9,7 @@ import (
 	karpv1 "sigs.k8s.io/karpenter/pkg/apis/v1"
 
 	commonk8s "github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/k8s"
-	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/install/guess"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/guess"
 	"github.com/DataDog/datadog-operator/pkg/version"
 )
 
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/uninstall/uninstall.go b/cmd/kubectl-datadog/autoscaling/cluster/uninstall/uninstall.go
index 650bc617ca..eb2bf767c0 100644
--- a/cmd/kubectl-datadog/autoscaling/cluster/uninstall/uninstall.go
+++ b/cmd/kubectl-datadog/autoscaling/cluster/uninstall/uninstall.go
@@ -34,12 +34,13 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	karpv1 "sigs.k8s.io/karpenter/pkg/apis/v1"
 
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/apply"
 	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/aws"
 	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/clients"
 	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/display"
 	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/helm"
 	commonk8s "github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/k8s"
-	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/install/guess"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/guess"
 	"github.com/DataDog/datadog-operator/pkg/plugin/common"
 )
 
@@ -121,15 +122,11 @@ func (o *options) run(cmd *cobra.Command) error {
 	log.SetOutput(cmd.OutOrStderr())
 	ctrl.SetLogger(zap.New(zap.UseDevMode(false), zap.WriteTo(cmd.ErrOrStderr())))
 
-	if clusterName == "" {
-		if name, err := clients.GetClusterNameFromKubeconfig(o.ConfigFlags); err != nil {
-			return err
-		} else if name != "" {
-			clusterName = name
-		} else {
-			return errors.New("cluster name must be specified either via --cluster-name or in the current kubeconfig context")
-		}
+	resolved, err := clients.ResolveClusterName(o.ConfigFlags, clusterName)
+	if err != nil {
+		return err
 	}
+	clusterName = resolved
 
 	display.PrintBox(cmd.OutOrStdout(), "Uninstalling Karpenter from cluster "+clusterName+".")
 
@@ -563,8 +560,8 @@ func deleteKarpenterInstanceProfiles(ctx context.Context, cli *clients.Clients,
 
 func listCloudFormationStacks(ctx context.Context, cli *clients.Clients, clusterName string) ([]string, error) {
 	stackNames := []string{
-		"dd-karpenter-" + clusterName + "-karpenter",
-		"dd-karpenter-" + clusterName + "-dd-karpenter",
+		apply.KarpenterStackName(clusterName),
+		apply.DDKarpenterStackName(clusterName),
 	}
 
 	var existing []string
@@ -581,11 +578,11 @@ func listCloudFormationStacks(ctx context.Context, cli *clients.Clients, cluster
 }
 
 func deleteCloudFormationStacks(ctx context.Context, cli *clients.Clients, clusterName string) error {
-	if err := aws.DeleteStack(ctx, cli.CloudFormation, "dd-karpenter-"+clusterName+"-dd-karpenter"); err != nil {
+	if err := aws.DeleteStack(ctx, cli.CloudFormation, apply.DDKarpenterStackName(clusterName)); err != nil {
 		return fmt.Errorf("failed to delete dd-karpenter CloudFormation stack: %w", err)
 	}
 
-	if err := aws.DeleteStack(ctx, cli.CloudFormation, "dd-karpenter-"+clusterName+"-karpenter"); err != nil {
+	if err := aws.DeleteStack(ctx, cli.CloudFormation, apply.KarpenterStackName(clusterName)); err != nil {
 		return fmt.Errorf("failed to delete karpenter CloudFormation stack: %w", err)
 	}
 
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/update/update.go b/cmd/kubectl-datadog/autoscaling/cluster/update/update.go
new file mode 100644
index 0000000000..796650a079
--- /dev/null
+++ b/cmd/kubectl-datadog/autoscaling/cluster/update/update.go
@@ -0,0 +1,224 @@
+// Package update provides the cobra command that refreshes a previously
+// installed kubectl-datadog Karpenter deployment on an EKS cluster. It
+// auto-detects immutable parameters (namespace, install-mode, fargate-subnets)
+// from the dd-karpenter CloudFormation stack laid down at install time and
+// refuses to touch a Karpenter installation it did not create.
+package update
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os/signal"
+	"slices"
+	"strings"
+	"syscall"
+
+	"github.com/spf13/cobra"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/apply"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/aws"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/clients"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/display"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/guess"
+	"github.com/DataDog/datadog-operator/pkg/plugin/common"
+)
+
+var updateExample = `
+  # update a previously installed kubectl-datadog Karpenter deployment
+  %[1]s update
+`
+
+// options bundles flag-bound state. update only exposes flags for parameters
+// that can change between the original install and a subsequent update; the
+// immutable parameters (namespace, install-mode, fargate-subnets) are
+// auto-detected from the dd-karpenter CFN stack and never accepted as flags.
+type options struct {
+	genericclioptions.IOStreams
+	common.Options
+	args []string
+
+	clusterName              string
+	karpenterVersion         string
+	createKarpenterResources apply.CreateKarpenterResources
+	inferenceMethod          apply.InferenceMethod
+	debug                    bool
+}
+
+func newOptions(streams genericclioptions.IOStreams) *options {
+	o := &options{
+		IOStreams: streams,
+		// Default `none` (vs install's `all`): a flagless update preserves
+		// any hand-edits to the EC2NodeClass / NodePool resources. Pass
+		// --create-karpenter-resources=all to regenerate them.
+		createKarpenterResources: apply.CreateKarpenterResourcesNone,
+		inferenceMethod:          apply.InferenceMethodNodeGroups,
+	}
+	o.SetConfigFlags()
+	return o
+}
+
+// New returns the cobra command for `kubectl datadog autoscaling cluster update`.
+func New(streams genericclioptions.IOStreams) *cobra.Command {
+	o := newOptions(streams)
+	cmd := &cobra.Command{
+		Use:          "update",
+		Short:        "Update an existing autoscaling installation on an EKS cluster",
+		Example:      fmt.Sprintf(updateExample, "kubectl datadog autoscaling cluster"),
+		SilenceUsage: true,
+		RunE: func(c *cobra.Command, args []string) error {
+			if err := o.complete(c, args); err != nil {
+				return err
+			}
+			if err := o.validate(); err != nil {
+				return err
+			}
+			return o.run()
+		},
+	}
+
+	cmd.Flags().StringVar(&o.clusterName, "cluster-name", "", "Name of the EKS cluster")
+	cmd.Flags().StringVar(&o.karpenterVersion, "karpenter-version", "", "Version of Karpenter to upgrade to (default to latest)")
+	cmd.Flags().Var(&o.createKarpenterResources, "create-karpenter-resources", "Which Karpenter resources to (re-)create: none (default), ec2nodeclass, all")
+	cmd.Flags().Var(&o.inferenceMethod, "inference-method", "Method to infer EC2NodeClass and NodePool properties when --create-karpenter-resources is set: nodes, nodegroups")
+	cmd.Flags().BoolVar(&o.debug, "debug", false, "Enable debug logs")
+
+	o.ConfigFlags.AddFlags(cmd.Flags())
+
+	return cmd
+}
+
+func (o *options) complete(cmd *cobra.Command, args []string) error {
+	o.args = args
+	return o.Init(cmd)
+}
+
+func (o *options) validate() error {
+	if len(o.args) > 0 {
+		return errors.New("no arguments are allowed")
+	}
+
+	if !slices.Contains([]apply.CreateKarpenterResources{apply.CreateKarpenterResourcesNone, apply.CreateKarpenterResourcesEC2NodeClass, apply.CreateKarpenterResourcesAll}, o.createKarpenterResources) {
+		return errors.New("create-karpenter-resources must be one of none, ec2nodeclass or all")
+	}
+
+	if !slices.Contains([]apply.InferenceMethod{apply.InferenceMethodNodes, apply.InferenceMethodNodeGroups}, o.inferenceMethod) {
+		return errors.New("inference-method must be one of nodes or nodegroups")
+	}
+
+	return nil
+}
+
+func (o *options) run() error {
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	clusterName, err := clients.ResolveClusterName(o.ConfigFlags, o.clusterName)
+	if err != nil {
+		return err
+	}
+
+	// Refuse early if no kubectl-datadog Karpenter is installed, or if a
+	// Karpenter installed by a different tool occupies the cluster — we
+	// never modify what we did not install. Run this check before AWS
+	// client setup so a flaky AWS does not mask the "run install first"
+	// signal the user actually needs.
+	k, err := guess.FindKarpenterInstallation(ctx, o.Clientset)
+	if err != nil {
+		return fmt.Errorf("failed to check for an existing Karpenter installation: %w", err)
+	}
+	if k == nil {
+		return fmt.Errorf("no Karpenter installation found on cluster %s; run 'kubectl datadog autoscaling cluster install' first", clusterName)
+	}
+	if !k.IsOwn() {
+		display.PrintBox(o.Out,
+			"A Karpenter installation managed by another tool was found on cluster "+clusterName+":",
+			"Deployment "+k.Namespace+"/"+k.Name+".",
+			"",
+			"kubectl-datadog will not modify a Karpenter installation it did not create.",
+		)
+		return fmt.Errorf("refusing to update Karpenter installation %s/%s not created by kubectl-datadog", k.Namespace, k.Name)
+	}
+
+	cli, err := clients.Build(ctx, o.ConfigFlags, o.Clientset)
+	if err != nil {
+		return fmt.Errorf("failed to build clients: %w", err)
+	}
+
+	if err = clients.ValidateAWSAccountConsistency(ctx, cli, clusterName, o.ConfigFlags); err != nil {
+		return err
+	}
+
+	ddStackName := apply.DDKarpenterStackName(clusterName)
+	ddStack, err := aws.GetStack(ctx, cli.CloudFormation, ddStackName)
+	if err != nil {
+		return fmt.Errorf("failed to read CloudFormation stack %s: %w", ddStackName, err)
+	}
+	if ddStack == nil {
+		return fmt.Errorf("Karpenter Deployment %s/%s exists but its CloudFormation stack %s was not found; install state is inconsistent — re-run 'install' to recover",
+			k.Namespace, k.Name, ddStackName)
+	}
+
+	opts, err := o.resolveOptions(clusterName, ddStack)
+	if err != nil {
+		return err
+	}
+
+	// apply.Run treats a Deployment in a different namespace than what we
+	// pass it as a foreign install (no-op success). For update we want to
+	// surface the inconsistency loudly instead.
+	if k.Namespace != opts.KarpenterNamespace {
+		return fmt.Errorf("inconsistent state: Karpenter Deployment %s/%s does not match CloudFormation stack %s namespace %s — re-run 'install' to recover",
+			k.Namespace, k.Name, ddStackName, opts.KarpenterNamespace)
+	}
+
+	return apply.Run(ctx, o.IOStreams, o.ConfigFlags, o.Clientset, opts)
+}
+
+// resolveOptions builds the apply.RunOptions to pass to apply.Run, using the
+// dd-karpenter CFN stack as the source of truth for the immutable parameters
+// (namespace, install-mode, fargate-subnets). update never accepts these as
+// flags — the function reads them straight from the stack. Mutable values
+// (KarpenterVersion, CreateKarpenterResources, InferenceMethod, Debug) come
+// from the user-provided flags.
+func (o *options) resolveOptions(clusterName string, ddStack *aws.Stack) (apply.RunOptions, error) {
+	params := ddStack.ParameterMap()
+
+	detectedNamespace := params["KarpenterNamespace"]
+	if detectedNamespace == "" {
+		return apply.RunOptions{}, fmt.Errorf("CloudFormation stack %s has no KarpenterNamespace parameter; install state is inconsistent",
+			apply.DDKarpenterStackName(clusterName))
+	}
+
+	detectedMode := apply.DetectedInstallMode(ddStack)
+	// Reject a corrupt or unknown tag here so we surface a clear error before
+	// apply.Run mutates the mode-independent CFN stack and only then crashes
+	// on the unsupported mode in its switch statement.
+	switch detectedMode {
+	case apply.InstallModeFargate, apply.InstallModeExistingNodes:
+	default:
+		return apply.RunOptions{}, fmt.Errorf("CloudFormation stack %s has unsupported install-mode tag %q",
+			apply.DDKarpenterStackName(clusterName), detectedMode)
+	}
+
+	var detectedSubnets []string
+	if detectedMode == apply.InstallModeFargate {
+		if raw := params["FargateSubnets"]; raw != "" {
+			detectedSubnets = strings.Split(raw, ",")
+			slices.Sort(detectedSubnets)
+		}
+	}
+
+	return apply.RunOptions{
+		ClusterName:              clusterName,
+		KarpenterNamespace:       detectedNamespace,
+		KarpenterVersion:         o.karpenterVersion,
+		InstallMode:              detectedMode,
+		FargateSubnets:           detectedSubnets,
+		CreateKarpenterResources: o.createKarpenterResources,
+		InferenceMethod:          o.inferenceMethod,
+		Debug:                    o.debug,
+		ActionLabel:              "Updating",
+	}, nil
+}
diff --git a/cmd/kubectl-datadog/autoscaling/cluster/update/update_test.go b/cmd/kubectl-datadog/autoscaling/cluster/update/update_test.go
new file mode 100644
index 0000000000..1b10c350d2
--- /dev/null
+++ b/cmd/kubectl-datadog/autoscaling/cluster/update/update_test.go
@@ -0,0 +1,182 @@
+package update
+
+import (
+	"testing"
+
+	awssdk "github.com/aws/aws-sdk-go-v2/aws"
+	cfntypes "github.com/aws/aws-sdk-go-v2/service/cloudformation/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/apply"
+	"github.com/DataDog/datadog-operator/cmd/kubectl-datadog/autoscaling/cluster/common/aws"
+)
+
+// stackFixture builds a *aws.Stack out of two maps so each test case can
+// declare the parameters and tags it cares about without boilerplate.
+func stackFixture(params, tags map[string]string) *aws.Stack {
+	s := &cfntypes.Stack{StackName: awssdk.String("test-stack")}
+	for k, v := range params {
+		s.Parameters = append(s.Parameters, cfntypes.Parameter{
+			ParameterKey:   awssdk.String(k),
+			ParameterValue: awssdk.String(v),
+		})
+	}
+	for k, v := range tags {
+		s.Tags = append(s.Tags, cfntypes.Tag{
+			Key:   awssdk.String(k),
+			Value: awssdk.String(v),
+		})
+	}
+	return &aws.Stack{Stack: s}
+}
+
+func TestResolveOptions(t *testing.T) {
+	const clusterName = "my-cluster"
+
+	t.Run("auto-detection fargate", func(t *testing.T) {
+		stack := stackFixture(
+			map[string]string{
+				"KarpenterNamespace": "dd-karpenter",
+				"FargateSubnets":     "subnet-bbb,subnet-aaa",
+			},
+			map[string]string{apply.InstallModeTagKey: string(apply.InstallModeFargate)},
+		)
+		o := &options{
+			karpenterVersion:         "1.0.0",
+			createKarpenterResources: apply.CreateKarpenterResourcesNone,
+			inferenceMethod:          apply.InferenceMethodNodeGroups,
+		}
+
+		opts, err := o.resolveOptions(clusterName, stack)
+		require.NoError(t, err)
+
+		assert.Equal(t, clusterName, opts.ClusterName)
+		assert.Equal(t, "dd-karpenter", opts.KarpenterNamespace)
+		assert.Equal(t, apply.InstallModeFargate, opts.InstallMode)
+		assert.Equal(t, []string{"subnet-aaa", "subnet-bbb"}, opts.FargateSubnets,
+			"FargateSubnets must be sorted so reruns produce identical CFN parameter values")
+		assert.Equal(t, "1.0.0", opts.KarpenterVersion)
+		assert.Equal(t, apply.CreateKarpenterResourcesNone, opts.CreateKarpenterResources)
+		assert.Equal(t, apply.InferenceMethodNodeGroups, opts.InferenceMethod)
+		assert.Equal(t, "Updating", opts.ActionLabel)
+	})
+
+	t.Run("auto-detection existing-nodes", func(t *testing.T) {
+		stack := stackFixture(
+			map[string]string{"KarpenterNamespace": "kube-system"},
+			map[string]string{apply.InstallModeTagKey: string(apply.InstallModeExistingNodes)},
+		)
+		o := &options{
+			createKarpenterResources: apply.CreateKarpenterResourcesAll,
+			inferenceMethod:          apply.InferenceMethodNodes,
+		}
+
+		opts, err := o.resolveOptions(clusterName, stack)
+		require.NoError(t, err)
+
+		assert.Equal(t, "kube-system", opts.KarpenterNamespace)
+		assert.Equal(t, apply.InstallModeExistingNodes, opts.InstallMode)
+		assert.Nil(t, opts.FargateSubnets,
+			"existing-nodes mode never carries fargate subnets")
+	})
+
+	t.Run("legacy stack without install-mode tag defaults to existing-nodes", func(t *testing.T) {
+		stack := stackFixture(
+			map[string]string{"KarpenterNamespace": "dd-karpenter"},
+			nil, // no install-mode tag
+		)
+		o := &options{
+			createKarpenterResources: apply.CreateKarpenterResourcesNone,
+			inferenceMethod:          apply.InferenceMethodNodeGroups,
+		}
+
+		opts, err := o.resolveOptions(clusterName, stack)
+		require.NoError(t, err)
+
+		assert.Equal(t, apply.InstallModeExistingNodes, opts.InstallMode,
+			"pre-tag stacks must be treated as install-mode=existing-nodes for backward compat")
+	})
+
+	t.Run("corrupt install-mode tag", func(t *testing.T) {
+		stack := stackFixture(
+			map[string]string{"KarpenterNamespace": "dd-karpenter"},
+			map[string]string{apply.InstallModeTagKey: "garbage"},
+		)
+		o := &options{}
+
+		_, err := o.resolveOptions(clusterName, stack)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "unsupported install-mode tag")
+	})
+
+	t.Run("missing KarpenterNamespace parameter", func(t *testing.T) {
+		stack := stackFixture(
+			nil,
+			map[string]string{apply.InstallModeTagKey: string(apply.InstallModeFargate)},
+		)
+		o := &options{}
+
+		_, err := o.resolveOptions(clusterName, stack)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "no KarpenterNamespace parameter")
+		assert.Contains(t, err.Error(), "install state is inconsistent")
+	})
+
+	t.Run("fargate stack without FargateSubnets parameter is tolerated", func(t *testing.T) {
+		// A legacy fargate stack predating the FargateSubnets parameter would
+		// still be readable by update; downstream CFN replay will recompute or
+		// fail loudly at template-apply time.
+		stack := stackFixture(
+			map[string]string{"KarpenterNamespace": "dd-karpenter"},
+			map[string]string{apply.InstallModeTagKey: string(apply.InstallModeFargate)},
+		)
+		o := &options{}
+
+		opts, err := o.resolveOptions(clusterName, stack)
+		require.NoError(t, err)
+		assert.Equal(t, apply.InstallModeFargate, opts.InstallMode)
+		assert.Nil(t, opts.FargateSubnets)
+	})
+}
+
+func TestValidate(t *testing.T) {
+	t.Run("rejects positional arguments", func(t *testing.T) {
+		o := &options{
+			args:                     []string{"oops"},
+			createKarpenterResources: apply.CreateKarpenterResourcesNone,
+			inferenceMethod:          apply.InferenceMethodNodeGroups,
+		}
+		err := o.validate()
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "no arguments are allowed")
+	})
+
+	t.Run("accepts valid combinations", func(t *testing.T) {
+		o := &options{
+			createKarpenterResources: apply.CreateKarpenterResourcesAll,
+			inferenceMethod:          apply.InferenceMethodNodes,
+		}
+		assert.NoError(t, o.validate())
+	})
+
+	t.Run("rejects unknown create-karpenter-resources", func(t *testing.T) {
+		o := &options{
+			createKarpenterResources: apply.CreateKarpenterResources("garbage"),
+			inferenceMethod:          apply.InferenceMethodNodeGroups,
+		}
+		err := o.validate()
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "create-karpenter-resources must be one of")
+	})
+
+	t.Run("rejects unknown inference-method", func(t *testing.T) {
+		o := &options{
+			createKarpenterResources: apply.CreateKarpenterResourcesNone,
+			inferenceMethod:          apply.InferenceMethod("garbage"),
+		}
+		err := o.validate()
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "inference-method must be one of")
+	})
+}
diff --git a/test/e2e/tests/autoscaling_suite/autoscaling_test.go b/test/e2e/tests/autoscaling_suite/autoscaling_test.go
index e6a31ec65e..3a670685b3 100644
--- a/test/e2e/tests/autoscaling_suite/autoscaling_test.go
+++ b/test/e2e/tests/autoscaling_suite/autoscaling_test.go
@@ -319,6 +319,66 @@ func (s *autoscalingSuite) TestAutoscalingInferenceMethodNodes() {
 	})
 }
 
+// TestAutoscalingUpdateRefusesWhenNoInstall asserts that `update` refuses to
+// run when no Karpenter installation is present on the cluster, surfacing a
+// clear error pointing the user at `install`.
+func (s *autoscalingSuite) TestAutoscalingUpdateRefusesWhenNoInstall() {
+	t := s.T()
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Minute)
+	defer cancel()
+
+	output, err := s.runKubectlDatadog(ctx, "autoscaling", "cluster", "update", "--cluster-name", s.clusterName)
+	require.Errorf(t, err, "Update should fail when no Karpenter is installed; got success.\nOutput:\n%s", output)
+	require.Containsf(t, output, "no Karpenter installation found",
+		"Expected explanatory error pointing at 'install'. Output:\n%s", output)
+}
+
+// TestAutoscalingUpdate exercises the install→update→uninstall happy path,
+// verifies idempotency, and confirms that `update` rejects flags that map to
+// immutable parameters (those flags are not exposed and pflag must reject
+// them as unknown).
+func (s *autoscalingSuite) TestAutoscalingUpdate() {
+	ctx := s.T().Context()
+
+	s.Run("Install fargate first", func() {
+		s.testInstall("--install-mode=fargate")
+		s.waitForAllPodsRunning(ctx)
+	})
+
+	s.Run("Update with no flags auto-detects parameters", func() {
+		s.testUpdate()
+		s.verifyKarpenterInstalled(ctx)
+		s.waitForAllPodsRunning(ctx)
+	})
+
+	s.Run("Update is idempotent", func() {
+		s.testUpdate()
+		s.verifyKarpenterInstalled(ctx)
+	})
+
+	s.Run("Update with --create-karpenter-resources=all does not error", func() {
+		s.testUpdate("--create-karpenter-resources=all")
+		s.verifyKarpenterInstalled(ctx)
+	})
+
+	s.Run("Update rejects immutable flags as unknown", func() {
+		t := s.T()
+		ctx2, cancel := context.WithTimeout(ctx, 5*time.Minute)
+		defer cancel()
+		output, err := s.runKubectlDatadog(ctx2, "autoscaling", "cluster", "update",
+			"--cluster-name", s.clusterName, "--install-mode=existing-nodes")
+		require.Errorf(t, err,
+			"Update should reject the unknown --install-mode flag.\nOutput:\n%s", output)
+		require.Containsf(t, output, "unknown flag",
+			"Expected pflag's 'unknown flag' error.\nOutput:\n%s", output)
+	})
+
+	s.Run("Uninstall cleans up resources", func() {
+		s.testUninstall()
+		s.waitForPendingPods(ctx, 1)
+	})
+}
+
 // testInstall tests the default install flow
 func (s *autoscalingSuite) testInstall(extraArgs ...string) {
 	t := s.T()
@@ -335,6 +395,25 @@ func (s *autoscalingSuite) testInstall(extraArgs ...string) {
 	s.verifyKarpenterInstalled(ctx)
 }
 
+// testUpdate runs the update subcommand against the current install. update
+// only accepts mutable flags (--karpenter-version, --create-karpenter-resources,
+// --inference-method, --debug) — immutable ones are auto-detected from the
+// dd-karpenter CFN stack.
+func (s *autoscalingSuite) testUpdate(extraArgs ...string) {
+	t := s.T()
+	ctx, cancel := context.WithTimeout(t.Context(), 25*time.Minute)
+	defer cancel()
+
+	// Run update
+	args := append([]string{"autoscaling", "cluster", "update", "--cluster-name", s.clusterName}, extraArgs...)
+	output, err := s.runKubectlDatadog(ctx, args...)
+	require.NoErrorf(t, err, "Update command failed. Output:\n%s", output)
+	t.Logf("Update output:\n%s", output)
+
+	// Verify installation
+	s.verifyKarpenterInstalled(ctx)
+}
+
 // testUninstall tests that uninstall removes all resources
 func (s *autoscalingSuite) testUninstall() {
 	t := s.T()