diff --git a/docs/operations.md b/docs/operations.md
index ec50fb9..8aeb006 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -69,7 +69,7 @@ byre.run and byre.team are registered at Porkbun, with Cloudflare as their DNS,
 - `https://dl.byre.run/` is the R2 bucket `byre`'s custom domain, holding what `mac/release.sh` uploads.
 - byre.team, and every path on it, redirects to `https://byre.run/` through a redirect rule on its zone (Rules → Redirect Rules in the dashboard), over proxied `AAAA 100::` records for `byre.team` and `www.byre.team`.
 
-`site/deploy.sh` and `mac/release.sh` read a Cloudflare API token from the generic password with service `byre-cloudflare` (`security add-generic-password -s byre-cloudflare -a cloudflare -w`, which prompts for it); it needs Account → Cloudflare Pages: Edit and Workers R2 Storage: Edit, and Zone → DNS: Edit, Single Redirect: Edit, Zone Settings: Edit and Cache Purge: Purge on both zones. byre.run's Browser Cache TTL is "Respect Existing Headers", so browsers keep the short cache on `byre.dmg` and `appcast.xml`.
+`site/deploy.sh` and `mac/release.sh` read a Cloudflare API token from the generic password with service `byre-cloudflare` (`security add-generic-password -s byre-cloudflare -a cloudflare -w`, which prompts for it); it needs Account → Cloudflare Pages: Edit and Workers R2 Storage: Edit, and Zone → DNS: Edit, Single Redirect: Edit, Zone Settings: Edit and Cache Purge: Purge on both zones. byre.run's Browser Cache TTL is "Respect Existing Headers", so browsers keep the short cache on `byre.dmg` and revalidate `appcast.xml` (`no-cache`) on every fetch. The app checks the appcast hourly (`SUScheduledCheckInterval` in `mac/Info.plist`, Sparkle's minimum).
 
 ## Agent vendors
 
diff --git a/mac/Info.plist b/mac/Info.plist
index 62a2249..38a06f5 100644
--- a/mac/Info.plist
+++ b/mac/Info.plist
@@ -24,6 +24,8 @@
 	<true/>
 	<key>SUAutomaticallyUpdate</key>
 	<true/>
+	<key>SUScheduledCheckInterval</key>
+	<integer>3600</integer>
 	<key>NSAppTransportSecurity</key>
 	<dict>
 		<key>NSAllowsArbitraryLoadsInWebContent</key>
diff --git a/mac/release.sh b/mac/release.sh
index 72c9955..9294e15 100755
--- a/mac/release.sh
+++ b/mac/release.sh
@@ -32,7 +32,7 @@ put() {
 put "$dmg" "$dmg" application/x-apple-diskimage "public, max-age=31536000, immutable"
 put "$dmg.sha256" "$dmg.sha256" text/plain "public, max-age=31536000, immutable"
 put byre.dmg "$dmg" application/x-apple-diskimage "public, max-age=300"
-put appcast.xml appcast.xml application/xml "public, max-age=300"
+put appcast.xml appcast.xml application/xml "no-cache"
 curl -fsS -o /dev/null -X POST -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" -H "Content-Type: application/json" --data '{"files":["https://dl.byre.run/byre.dmg","https://dl.byre.run/appcast.xml"]}' https://api.cloudflare.com/client/v4/zones/b53a5f8cb60313ba6789aba3559cb4b8/purge_cache
 
 request=$out/release.json