Autoupdate seems to work now, if a bit too well: I want to be able to decline, but autoupdate didn't offer that - just proceeded to update without my permission. Apex needs to provide an option to disable it if there's no prompt to allow bypassing it.