How to update n8n safely — and who patches it on your host

Short answer

Updating n8n safely is a sequence, not a button. Take a full backup first, check the release notes for breaking changes, test in a separate environment, then update by your install method. n8n's update docs say to try at least once a month. Who does that work depends on the host. n8n Cloud documents automatic security and stability updates. Every other host is filled only where its own page says so, and a dash means not yet verified. The host table was checked on October 18, 2026.

The monthly line is from n8n's update docs, checked Oct 18, 2026. The backup that has to come first is on n8n backups: a snapshot is not a backup. A dash in the table below is not a “no”, and it is not “does not patch”.

The safe-update sequence (backups first)

How do I update self-hosted n8n without losing my workflows or credentials?

Start with a full backup, then update. n8n's backup and restore docs say n8n recommends taking a full backup before updating. A full backup includes the .n8n folder, which holds the credential encryption key and, on the default install, the SQLite database, plus the external PostgreSQL database if you use one. Without that key, a restored database or an encrypted credential export cannot be decrypted. The step-by-step of what to copy, and why a CLI --backup export is workflows and credentials only, is on the backups page. This page does not re-teach it.

1. Take that full backup. What a complete n8n backup includes is the list, including external binary storage and N8N_CUSTOM_EXTENSIONS directories when you use them.
2. Read the release notes for breaking changes. n8n uses semantic versioning, MAJOR.MINOR.PATCH. A MAJOR version is an incompatible change which can require user action. A MINOR version adds functionality in a backward-compatible way. A PATCH version is a backward-compatible bug fix. Checked Oct 18, 2026.
3. Test in a separate environment. The update docs say to use Environments to create a test version of the instance and test the update there first. Choose branching patterns describes one way: a new instance on the new version, connected to the same Git branch, while production stays on the older version. A test instance needs its own resources. How much RAM and CPU n8n needs covers the SQLite-versus-Postgres choice that decides where the database lives during that test.
4. Update by the method you installed with. The update page links npm and Docker. The npm page says npm update -g n8n moves to latest, and npm install -g n8n@ plus a version installs that version. It also says npm-based installs are deprecated from n8n 3.0. The one-line setup says that from n8n 3.0, n8n is only distributed through Docker, that an existing npm install keeps working for now, and that new installs and future upgrades should use Docker. Its upgrade command edits N8N_VERSION and N8N_SANDBOX_VERSION in .env. It says your data, secrets, and other settings stay. The Docker page says its own content is outdated and points to Install using Docker Compose. The Docker page still shows docker compose pull, docker compose down, and docker compose up -d for a Compose file. The Compose page tells you to take the latest stable version number from n8n's releases. It does not print a version number of its own.
5. Log in, run one workflow, and confirm one credential decrypts and connects. This site has not run that check on a host.

Pre-update checklist

• A full backup, as defined on the backups page: the .n8n folder, including the credential encryption key, and the external PostgreSQL database if you use one. n8n recommends taking a full backup before updating.
• The release notes, read for breaking changes. In n8n's semantic versioning, a MAJOR version is an incompatible change which can require user action. A version number alone does not mean every feature on the release notes is already on your instance.
• A test in a separate environment before production. n8n's update docs say to use Environments to create a test version of the instance and test the update there first.
• The update for your install method, from n8n's own page for that method. npm, the Docker page, Docker Compose, and the one-line setup are different procedures.
• After the update: log in, run one workflow, and confirm one credential decrypts and connects. This site has not run that check on any host.

The first four items are the update, backup, and release-notes pages, checked Oct 18, 2026. The last item is the check this page asks you to make. It is not a result this site has recorded.

How often to update — and what “patch” means here

n8n's update docs say to try to update at least once a month. Updating more often is the reader's choice. This page does not turn that sentence into a deadline, and it does not discuss a named vulnerability. On the release notes, a PATCH version is a backward-compatible bug fix, a MINOR version is backward-compatible functionality, and a MAJOR version is an incompatible change which can require user action. The same page says publishing an entry does not guarantee the feature is available to you yet: some ship behind a feature flag, and others roll out gradually.

What do I check before a major n8n update?

The release notes, for breaking changes, then a test environment, then the full backup if you have not already taken it. The newest heading on the release notes on Oct 18, 2026 is n8n 2.43, released Oct 6, 2026. The Docker install page, which says that page is outdated, lists current stable 2.43.7 and current beta 2.44.3 on the same day. Those are two n8n figures with their dates, printed side by side.

Who patches what — managed, one-click, PaaS, Cloud, and bare VPS

Who patches n8n on managed hosting vs a VPS?

The dataset type is a billing label. “Managed”, “one-click”, “PaaS”, and a Docker image do not answer this. A host is good for staying patched only when its own docs cover the rows that apply.

1. Who acts. The host patches n8n automatically, the host patches on request, or the reader patches by npm or Docker. If the page does not name the actor, the cell stays —.
2. What is covered. The n8n application, or also the OS, Docker, and the database. If the page does not split that, the cell says scope not stated.
3. Which version, and whether you can pin, delay, or roll it back. Each of those stays — until the page says it.
4. Whether you can still take a full backup, read the release notes, and test first. An automatic update with no documented backup or rollback is a caveat to print.
5. How the host says it announces updates. If that page was not found, the cell stays —. This page does not promise that you will be notified.

Order below is dataset order. Affiliate status is not an input. This table is not a ranking, and it is not a “best for security” list. n8n Cloud is the row whose update settings are written down. It is the benchmark the other rows are read against. It is not a recommendation.

Disclosure: Some host links below are affiliate links. We may earn a commission if you sign up, at no extra cost to you. Prices and order are not affected.

Plan names are the plans in prices.json. Dated prices: n8n hosting prices — October 2026. Update add-on prices are quoted only where the host publishes them. How checks work. Price changelog.

A managed price is also paying for time you do not spend on the server. The dated tables are on what n8n costs at 2,500, 10,000, and 50,000 executions a month. The renewal-aware calculator is where you put your own time. For fit and price, see best n8n hosting, cheapest way to host n8n, and free n8n hosting. Those pages do not name a most secure host.

On n8n Cloud, updating is a settings page

Does n8n Cloud update automatically?

Yes, for security and stability. From Update your version, checked Oct 18, 2026: only the instance owner can change update settings. Changing the version triggers a 1 to 2 minute restart. Other maintenance settings apply without a restart.

• Release track. Beta delivers new releases as soon as they are ready. Stable is a later, more proven patch, after time on Beta. n8n recommends Stable for mission-critical workloads. You can switch tracks.
• Cadence. n8n always applies security and stability updates automatically, whichever cadence you choose. Security & stability upgrades about every two weeks and is recommended for most workspaces. Every new release upgrades to each release as it ships, on average one release per day.
• Maintenance window. Upgrade anytime, or only during a window you pick. Times use the timezone shown above the setting.
• Version. A dropdown sets the version. Change version applies it. Open changelog compares versions.

This section is n8n Cloud only. No other host on this page is documented to work this way unless its table row says so with a source.

If the update breaks something (rollback reality)

Can I roll back a bad n8n update?

Restore the full backup you took before the update. The backup and restore docs describe that backup as a way to roll back a failed update, and the restore steps are on the backups page. A CLI export can move workflows and credentials. It does not include users, execution history, variables, or instance settings, including the encryption key, so it cannot recover the instance on its own.

On an npm install, the npm page has a “Reverting an upgrade” section: install the older version you want, and if the upgrade involved a database migration, check the release notes and run n8n db:revert on the current version. Repeating that reverts more than one migration. The Docker page shows docker pull n8nio/n8n plus a tag for a specific version, and it says that page is outdated. A host rollback, a snapshot treated as an update rollback, or a restore time is in the table only when that host's page says it. Elestio documents a downgrade and says it can cause data loss. That limit stays on Elestio's row.

A patch routine you can actually keep

The host table is what each host documents. The routine that does not depend on one panel:

1. Update at least once a month, which is the floor in n8n's update docs. Anything more often is your choice. It is not a benchmark this page sets.
2. Read the release notes before you update, including the feature-flag and gradual-rollout note.
3. Write down the version before the update and the version after it, with the date. The two n8n figures above are an example of writing both numbers down. They are not a score for a host.
4. Keep the pre-update backup until the new version has run real workflows. Where a host publishes how long it keeps a backup, the backups page quotes it. This page does not add a number of its own.

FAQ

How often should I update n8n?

n8n's update docs say to try to update at least once a month, so you are not jumping multiple versions at once. That is the documented floor. This page does not add a shorter deadline. Checked Oct 18, 2026.

Do managed n8n hosts patch for me?

Only where that host's own page says who acts, what is covered, and what you can delay. Managed is a label in the dataset, not a patching promise. n8n Cloud documents automatic security and stability updates, with the owner choosing the track, cadence, and maintenance window. Elestio's n8n features page says it updates n8n to the latest version unless you disable that. Hostinger's Managed n8n overview says automatic software updates and does not say whether that is the n8n application or whether you can pin a version. Railway's official pages contradict each other on Docker-image checks, so that cell stays unverified. Every other managed or PaaS claim is in the table, with a dash where the page did not say. A dash means not yet verified. It does not mean the host does not patch. Checked Oct 18, 2026.

Does a one-click install include updates?

A one-click or preinstalled image proves the install the host documented, not a patching schedule. Contabo's help article says that after installation you are responsible for maintaining, updating, and troubleshooting the application. OVHcloud's n8n VPS page says n8n is pre-installed and that you keep n8n updated, and it points to n8n's docs. Hostinger's KVM update article tells the reader to select Update or to pull the image. Checked Oct 18, 2026.

What should I do before a major-version update?

Take a full backup first. n8n's backup docs say n8n recommends a full backup before updating. A full backup includes the .n8n folder, which holds the credential encryption key, and the external database if you use PostgreSQL. Without that key, a restored database or encrypted credential export cannot be decrypted. Then read the release notes for breaking changes. n8n's semantic versioning says a MAJOR version is an incompatible change which can require user action. Then test in a separate environment. The update docs say to use Environments for that test. Checked Oct 18, 2026.

Can I roll back a bad update?

Restore the full backup you took before the update. n8n's backup docs describe that backup as a way to roll back a failed update. A CLI export of workflows and credentials does not include the encryption key, so it cannot recover the instance on its own. On an npm install, n8n's npm page says to install the older version, and, if the upgrade migrated the database, to run n8n db:revert on the current version before you go back. The Docker install page shows how to pull a specific image tag and also says that page is outdated. No host rollback is claimed in this answer. Host rows that document one are in the table, with the limit that page printed. Checked Oct 18, 2026.

Is my host behind on n8n versions?

No host in this table publishes an exact n8n version number, so this page does not put a host version beside n8n's. On Oct 18, 2026, the newest heading on n8n's release notes was n8n 2.43, released Oct 6, 2026. The same day, the Docker install page, which says its own content is outdated, listed current stable 2.43.7 and current beta 2.44.3. Those two n8n figures sit side by side as dated numbers. No host version is printed next to them.