diff --git a/packages/cli/src/interactiveCli.tsx b/packages/cli/src/interactiveCli.tsx
index 18926dc79d..fd8d71f57f 100644
--- a/packages/cli/src/interactiveCli.tsx
+++ b/packages/cli/src/interactiveCli.tsx
@@ -179,7 +179,12 @@ export async function startInteractiveUI(
 
   checkForUpdates(settings)
     .then((info) => {
-      handleAutoUpdate(info, settings, config.getProjectRoot());
+      handleAutoUpdate(
+        info,
+        settings,
+        config.getProjectRoot(),
+        config.getSandboxEnabled(),
+      );
     })
     .catch((err) => {
       // Silently ignore update check errors.
diff --git a/packages/cli/src/utils/handleAutoUpdate.test.ts b/packages/cli/src/utils/handleAutoUpdate.test.ts
index ef18864d81..803a40141c 100644
--- a/packages/cli/src/utils/handleAutoUpdate.test.ts
+++ b/packages/cli/src/utils/handleAutoUpdate.test.ts
@@ -96,7 +96,7 @@ describe('handleAutoUpdate', () => {
   });
 
   it('should do nothing if update info is null', () => {
-    handleAutoUpdate(null, mockSettings, '/root', mockSpawn);
+    handleAutoUpdate(null, mockSettings, '/root', false, mockSpawn);
     expect(mockGetInstallationInfo).not.toHaveBeenCalled();
     expect(updateEventEmitter.emit).not.toHaveBeenCalled();
     expect(mockSpawn).not.toHaveBeenCalled();
@@ -112,7 +112,7 @@ describe('handleAutoUpdate', () => {
 
     expect(isUpdateInProgress()).toBe(false);
 
-    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
 
     expect(isUpdateInProgress()).toBe(true);
 
@@ -129,7 +129,7 @@ describe('handleAutoUpdate', () => {
       packageManager: PackageManager.NPM,
     });
 
-    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
 
     expect(isUpdateInProgress()).toBe(true);
 
@@ -178,7 +178,7 @@ describe('handleAutoUpdate', () => {
 
   it('should do nothing if update prompts are disabled', () => {
     mockSettings.merged.general.enableAutoUpdateNotification = false;
-    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
     expect(mockGetInstallationInfo).not.toHaveBeenCalled();
     expect(updateEventEmitter.emit).not.toHaveBeenCalled();
     expect(mockSpawn).not.toHaveBeenCalled();
@@ -193,7 +193,7 @@ describe('handleAutoUpdate', () => {
       packageManager: PackageManager.NPM,
     });
 
-    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
 
     expect(updateEventEmitter.emit).toHaveBeenCalledTimes(1);
     expect(updateEventEmitter.emit).toHaveBeenCalledWith('update-received', {
@@ -219,7 +219,7 @@ describe('handleAutoUpdate', () => {
         packageManager,
       });
 
-      handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+      handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
 
       expect(updateEventEmitter.emit).not.toHaveBeenCalled();
       expect(mockSpawn).not.toHaveBeenCalled();
@@ -234,7 +234,7 @@ describe('handleAutoUpdate', () => {
       packageManager: PackageManager.NPM,
     });
 
-    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
 
     expect(updateEventEmitter.emit).toHaveBeenCalledTimes(1);
     expect(updateEventEmitter.emit).toHaveBeenCalledWith('update-received', {
@@ -253,7 +253,7 @@ describe('handleAutoUpdate', () => {
       packageManager: PackageManager.NPM,
     });
 
-    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
 
     expect(updateEventEmitter.emit).toHaveBeenCalledTimes(1);
     expect(updateEventEmitter.emit).toHaveBeenCalledWith('update-received', {
@@ -276,7 +276,7 @@ describe('handleAutoUpdate', () => {
       mockChildProcess.emit('close', 0);
     }, 0);
 
-    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
 
     expect(mockSpawn).toHaveBeenCalledOnce();
   });
@@ -296,7 +296,7 @@ describe('handleAutoUpdate', () => {
         resolve();
       }, 0);
 
-      handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+      handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
     });
 
     expect(updateEventEmitter.emit).toHaveBeenCalledWith('update-failed', {
@@ -320,7 +320,7 @@ describe('handleAutoUpdate', () => {
         resolve();
       }, 0);
 
-      handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+      handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
     });
 
     expect(updateEventEmitter.emit).toHaveBeenCalledWith('update-failed', {
@@ -345,7 +345,7 @@ describe('handleAutoUpdate', () => {
       packageManager: PackageManager.NPM,
     });
 
-    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
 
     expect(mockSpawn).toHaveBeenCalledWith(
       'npm i -g @google/gemini-cli@nightly',
@@ -372,7 +372,7 @@ describe('handleAutoUpdate', () => {
       packageManager: PackageManager.NPM,
     });
 
-    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
 
     expect(mockSpawn).not.toHaveBeenCalled();
   });
@@ -392,7 +392,7 @@ describe('handleAutoUpdate', () => {
         resolve();
       }, 0);
 
-      handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', mockSpawn);
+      handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', false, mockSpawn);
     });
 
     expect(updateEventEmitter.emit).toHaveBeenCalledWith('update-success', {
@@ -400,6 +400,15 @@ describe('handleAutoUpdate', () => {
         'Update successful! The new version will be used on your next run.',
     });
   });
+
+  it('should suppress update if isSandboxEnabled is true', () => {
+    handleAutoUpdate(mockUpdateInfo, mockSettings, '/root', true, mockSpawn);
+
+    expect(updateEventEmitter.emit).toHaveBeenCalledWith('update-info', {
+      message: `${mockUpdateInfo.message}\nAutomatic update is not available in sandbox mode.`,
+    });
+    expect(mockSpawn).not.toHaveBeenCalled();
+  });
 });
 
 describe('setUpdateHandler', () => {
diff --git a/packages/cli/src/utils/handleAutoUpdate.ts b/packages/cli/src/utils/handleAutoUpdate.ts
index cd39cd926d..0071ed7a2f 100644
--- a/packages/cli/src/utils/handleAutoUpdate.ts
+++ b/packages/cli/src/utils/handleAutoUpdate.ts
@@ -68,13 +68,14 @@ export function handleAutoUpdate(
   info: UpdateObject | null,
   settings: LoadedSettings,
   projectRoot: string,
+  isSandboxEnabled: boolean,
   spawnFn: typeof spawn = spawnWrapper,
 ) {
   if (!info) {
     return;
   }
 
-  if (settings.merged.tools.sandbox || process.env['GEMINI_SANDBOX']) {
+  if (isSandboxEnabled) {
     updateEventEmitter.emit('update-info', {
       message: `${info.message}\nAutomatic update is not available in sandbox mode.`,
     });