diff --git a/mole b/mole
index a00fbc3..13ace9c 100755
--- a/mole
+++ b/mole
@@ -737,11 +737,11 @@ show_main_menu() {
 
     if [[ -t 0 ]]; then
         printf '\r\033[2K\n'
-        local controls="${GRAY}↑↓  |  Enter  |  M More  |  "
+        local controls="${GRAY}↑↓  |  Enter  |  M More"
         if ! is_touchid_configured; then
-            controls="${controls}T TouchID"
-        else
-            controls="${controls}U Update"
+            controls="${controls}  |  T TouchID"
+        elif [[ "${MAIN_MENU_SHOW_UPDATE:-false}" == "true" ]]; then
+            controls="${controls}  |  U Update"
         fi
         controls="${controls}  |  Q Quit${NC}"
         printf '\r\033[2K%s\n' "$controls"
@@ -765,6 +765,7 @@ interactive_main_menu() {
         update_message="$(cat "$msg_cache" 2> /dev/null || echo "")"
     fi
     MAIN_MENU_UPDATE_MESSAGE="$update_message"
+    MAIN_MENU_SHOW_UPDATE="$([[ -n "$update_message" ]] && echo true || echo false)"
 
     cleanup_and_exit() {
         show_cursor
@@ -835,6 +836,7 @@ interactive_main_menu() {
                 exec "$SCRIPT_DIR/bin/touchid.sh"
                 ;;
             "UPDATE")
+                [[ "${MAIN_MENU_SHOW_UPDATE:-false}" == "true" ]] || continue
                 show_cursor
                 clear
                 update_mole
@@ -940,6 +942,8 @@ main() {
     esac
 }
 
-if [[ "${MOLE_SKIP_MAIN:-0}" != "1" ]]; then
+if [[ "${MOLE_TEST_MODE:-0}" == "1" && "${MOLE_SKIP_MAIN:-0}" == "1" ]]; then
+    :
+else
     main "$@"
 fi
diff --git a/tests/cli.bats b/tests/cli.bats
index 7ce8f6a..44882fd 100644
--- a/tests/cli.bats
+++ b/tests/cli.bats
@@ -89,6 +89,74 @@ EOF
 	[[ "$output" == *"Unknown uninstall option: --whitelist"* ]]
 }
 
+@test "show_main_menu hides update shortcut when no update notice is available" {
+	run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+HOME="$(mktemp -d)"
+export HOME MOLE_TEST_MODE=1 MOLE_SKIP_MAIN=1
+source "$PROJECT_ROOT/mole"
+show_brand_banner() { printf 'banner\n'; }
+show_menu_option() { printf '%s' "$2"; }
+MAIN_MENU_BANNER=""
+MAIN_MENU_UPDATE_MESSAGE=""
+MAIN_MENU_SHOW_UPDATE=false
+show_main_menu 1 true
+EOF
+
+	[ "$status" -eq 0 ]
+	[[ "$output" != *"U Update"* ]]
+}
+
+@test "interactive_main_menu ignores U shortcut when update notice is hidden" {
+	run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+HOME="$(mktemp -d)"
+export HOME MOLE_TEST_MODE=1 MOLE_SKIP_MAIN=1
+source "$PROJECT_ROOT/mole"
+show_brand_banner() { :; }
+show_main_menu() { :; }
+hide_cursor() { :; }
+show_cursor() { :; }
+clear() { :; }
+update_mole() { echo "UPDATE_CALLED"; }
+state_file="$HOME/read_key_state"
+read_key() {
+    if [[ ! -f "$state_file" ]]; then
+        : > "$state_file"
+        echo "UPDATE"
+    else
+        echo "QUIT"
+    fi
+}
+interactive_main_menu
+EOF
+
+	[ "$status" -eq 0 ]
+	[[ "$output" != *"UPDATE_CALLED"* ]]
+}
+
+@test "interactive_main_menu accepts U shortcut when update notice is visible" {
+	run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+HOME="$(mktemp -d)"
+export HOME MOLE_TEST_MODE=1 MOLE_SKIP_MAIN=1
+mkdir -p "$HOME/.cache/mole"
+printf 'update available\n' > "$HOME/.cache/mole/update_message"
+source "$PROJECT_ROOT/mole"
+show_brand_banner() { :; }
+show_main_menu() { :; }
+hide_cursor() { :; }
+show_cursor() { :; }
+clear() { :; }
+update_mole() { echo "UPDATE_CALLED"; }
+read_key() { echo "UPDATE"; }
+interactive_main_menu
+EOF
+
+	[ "$status" -eq 0 ]
+	[[ "$output" == *"UPDATE_CALLED"* ]]
+}
+
 @test "touchid status reports current configuration" {
 	run env HOME="$HOME" "$PROJECT_ROOT/mole" touchid status
 	[ "$status" -eq 0 ]