@@ -74,7 +74,7 @@ specify bundle install <bundle_id | path>
 
 Installs a bundle's full component set through each primitive's machinery. The argument may be a catalog bundle id, or a local path to a built `.zip` artifact, a bundle directory, or a `bundle.yml` file; local sources install directly without consulting the catalog stack.
 
-If the current directory is not yet a Spec Kit project, `install` initializes one first so a fresh checkout reaches a working state in a single command. `--integration` selects the integration when initializing a new project, and confirms the target when a bundle pins a specific integration but the project's active integration can't be determined (missing or unreadable `.specify/integration.json`). It does **not** override an already-initialized project's active integration: if a bundle targets a different integration than the project's, install aborts with no changes. Integration-agnostic bundles inherit the project's active integration. Without `--refresh`, installation is idempotent — already-installed components matching their pins are skipped. A missing or different installed version cannot satisfy a pin. Only `--refresh` can repair a drifted version owned exclusively by this bundle; independently installed components are skipped and never adopted or replaced. On failure, no provenance record is written (a failed install records nothing), and the components installed during that run are removed on a best-effort basis — removal errors are swallowed, so partial on-disk state may remain.
+If the current directory is not yet a Spec Kit project, `install` initializes one first so a fresh checkout reaches a working state in a single command. `--integration` selects the integration when initializing a new project, and confirms the target when a bundle pins a specific integration but the project's active integration can't be determined (missing or unreadable `.specify/integration.json`). It does **not** override an already-initialized project's active integration: if a bundle targets a different integration than the project's, install aborts with no changes. Integration-agnostic bundles inherit the project's active integration. Without `--refresh`, installation is idempotent — already-installed components matching their pins are skipped, as are bundle-owned compatible packaged patch releases with a warning (see below). Other differing or missing installed versions cannot satisfy a pin. Only `--refresh` can repair a drifted version owned exclusively by this bundle; independently installed components are skipped and never adopted or replaced. On failure, no provenance record is written (a failed install records nothing), and the components installed during that run are removed on a best-effort basis — removal errors are swallowed, so partial on-disk state may remain.
 
 Installed-bundle records store required component pins separately from contributed components. A compatible independently installed component satisfies a bundle's requirement but remains independently owned: its pin still blocks a later bundle from installing an incompatible version, while removing the bundle does not uninstall it. An unpinned install or refresh cannot replace a component another bundle requires at a pinned version; sharing an already installed matching version without refreshing remains allowed. Shared bundles must also agree on component source and, for presets, priority and strategy before installing or refreshing the shared component. Older records without the requirement list retain their known contributed pins; reinstall or refresh the bundle to record its full requirements.
 
@@ -88,6 +88,23 @@ The source may also be a bundle directory or `.zip` artifact. Refresh uses the s
 
 A local bundle source supplies the manifest, not its component payloads. Components resolved through catalogs still require network access to refresh, even when already installed. Add `--offline` only when the components being installed or refreshed ship with Spec Kit; otherwise the command reports which component needs network access. Re-run without `--offline` to fetch that component through its catalog.
 
+**Packaged patch compatibility.** When an extension, preset, or workflow shipped
+with the CLI is a newer stable patch release within the pinned major/minor
+version, installation and refresh warn and use that packaged release. For
+example, a bundle pinning `bug` to `1.0.0` can use packaged `bug` `1.0.1` without
+editing its manifest. Validation reports the same warning. Downgrades,
+major/minor mismatches, and differing prerelease versions remain errors; an
+explicit component `source` also retains exact-pin enforcement. Catalog-resolved
+components still require exact matches. This exception improves compatibility
+across CLI upgrades, but a patch release is not a guarantee of unchanged behavior.
+
+Bundle records retain requested versions in `required_components` and
+`contributed_components` and
+store actual known installed versions under `installed_versions`, keyed by
+`kind:id` (for example, `"extensions:bug": "1.0.1"`). These are also visible in
+`specify bundle list --json`. Component version ranges, `latest`, and omitted
+extension versions are not supported.
+
 > **Step payloads resolve through the step catalog only.** A bundle's `provides.steps` entries still resolve exclusively through the active step catalogs. Bundle-local `steps/<id>/` payloads and relative `provides.steps[].source` overrides are **not** resolved in this release, so a step declared that way cannot be installed offline. To ship a step with a bundle today, publish it to a step catalog the bundle's users can reach.
 
 ## Catalog Release History
@@ -129,11 +146,11 @@ specify bundle update [<bundle_id>]
 | `--integration`  | Override the integration used when refreshing components; applied only when the project's active integration can't be determined |
 | `--offline`      | Do not access the network                                                                                             |
 
-Re-resolves a bundle and **refreshes** its components through each primitive's update path, bringing already-installed components up to the bundle's newly pinned versions while preserving primitive-level overrides (such as preset priority). Provide a bundle id, or use `--all` to update everything installed.
+Re-resolves a bundle and **refreshes** its components through each primitive's update path, bringing already-installed components up to the bundle's newly pinned versions (or compatible newer packaged patches, with a warning) while preserving primitive-level overrides (such as preset priority). Provide a bundle id, or use `--all` to update everything installed.
 
 **Pinned catalog releases.** Extensions, presets, workflows, and steps with version pins select that exact release from the highest-priority active catalog entry. Historical releases must be advertised under `releases` with their own artifact URL and SHA-256 digest; the bundler never guesses an old URL from the current one or falls through to another catalog. Legacy extension and preset entries that advertise no version are an exception: the bundler uses the winning entry as-is and cannot enforce its pin or verify the installed archive's version. Publish a versioned entry to make that pin enforceable. The primitive installer uses the selected workflow or step record without re-reading the catalog, and verifies downloaded archive or workflow/step metadata against that release. A pinned workflow that ships with Spec Kit uses its bundled copy when the version matches, and the catalog release when it differs and network access is allowed. A step without a pin installs the current catalog release.
 
-Without an explicit `source`, bundled extensions and presets take precedence over catalog releases. Validation rejects a pin that differs from the bundled version even when a matching catalog release exists; specify the winning catalog as `source` to opt into its release.
+Without an explicit `source`, bundled extensions and presets take precedence over catalog releases. Validation rejects an incompatible pin even when a matching catalog release exists; compatible newer stable packaged patches produce a warning instead. Specify the winning catalog as `source` to opt into its exact release.
 
 > **One installed version per component ID.** Bundles sharing a component must agree on its pinned version. A different or unknown pin from another bundle is rejected before installation, including during `bundle update`; refreshing one bundle cannot replace a version required by another.
 
 
@@ -8,6 +8,7 @@
 from __future__ import annotations
 
 from pathlib import Path
+from typing import TYPE_CHECKING
 
 import typer
 from rich.markup import escape as _escape_markup
@@ -17,6 +18,9 @@
 from .project import active_integration
 from .records import load_records
 
+if TYPE_CHECKING:
+    from .installer import InstallResult
+
 bundle_app = typer.Typer(
     name="bundle",
     help="Discover, install, and author Spec Kit bundles",
@@ -42,6 +46,11 @@ def _fail(message: str, *, as_json: bool = False) -> None:
     raise typer.Exit(code=1)
 
 
+def _render_install_warnings(result: InstallResult) -> None:
+    for warning in result.warnings:
+        err_console.print(f"[yellow]Warning:[/yellow] {_escape_markup(warning.message)}")
+
+
 def _user_config_dir() -> Path:
     # User-scope Spec Kit config lives under ~/.specify (same convention as
     # auth.json, extension/preset catalogs). Passing this through to the source
 
@@ -16,6 +16,7 @@
 import urllib.error
 import warnings
 from pathlib import Path
+from typing import TYPE_CHECKING
 from urllib.parse import ParseResult, urlparse
 from urllib.request import url2pathname
 
@@ -26,6 +27,9 @@
 from .manifest import ComponentRef
 from .yamlio import loads_json
 
+if TYPE_CHECKING:
+    from .primitives import BundledPatchWarning
+
 COMMUNITY_CATALOG_URL = (
     "https://raw.githubusercontent.com/github/spec-kit/main/"
     "bundles/catalog.community.json"
@@ -330,6 +334,22 @@ def installed_version(
         manager = self._manager_for(component, project_root)
         return manager.installed_version(component)
 
+    def bundled_patch_warning(
+        self, component: ComponentRef, actual: str,
+    ) -> BundledPatchWarning | None:
+        from .primitives import _bundled_component_version, _bundled_pin_warning
+        from .versioning import is_newer_patch, same_version
+
+        packaged = _bundled_component_version(component)
+        if (
+            component.version
+            and packaged
+            and same_version(actual, packaged)
+            and is_newer_patch(actual, component.version)
+        ):
+            return _bundled_pin_warning(component.kind[:-1].capitalize(), component, actual)
+        return None
+
     def validate_source(self, project_root: Path, component: ComponentRef) -> None:
         if not self._allow_network:
             raise BundlerError(
@@ -354,13 +374,17 @@ def validate_source(self, project_root: Path, component: ComponentRef) -> None:
             f"'{component.source}': {detail}."
         )
 
-    def install(self, project_root: Path, component: ComponentRef) -> None:
+    def install(
+        self, project_root: Path, component: ComponentRef,
+    ) -> BundledPatchWarning | None:
         manager = self._manager_for(component, project_root)
-        manager.install(component)
+        return manager.install(component)
 
-    def refresh(self, project_root: Path, component: ComponentRef) -> None:
+    def refresh(
+        self, project_root: Path, component: ComponentRef,
+    ) -> BundledPatchWarning | None:
         manager = self._manager_for(component, project_root)
-        manager.refresh(component)
+        return manager.refresh(component)
 
     def remove(self, project_root: Path, component: ComponentRef) -> None:
         manager = self._manager_for(component, project_root)
 
@@ -14,6 +14,7 @@
     _bundle_overlaps,
     _default_script_type,
     _fail,
+    _render_install_warnings,
     _resolve_init_integration,
     _run_init,
     _speckit_version,
@@ -143,6 +144,7 @@ def bundle_install(
         _fail(str(exc))
         return
 
+    _render_install_warnings(result)
     refresh_summary = (
         f", {len(result.refreshed)} refreshed, {len(result.uninstalled)} removed"
         if refresh
 
@@ -7,7 +7,13 @@
 
 from .._console import console
 from . import BundlerError
-from ._commands import _build_stack, _fail, _speckit_version, bundle_app
+from ._commands import (
+    _build_stack,
+    _fail,
+    _render_install_warnings,
+    _speckit_version,
+    bundle_app,
+)
 from .project import active_integration, require_project_root
 from .records import load_records
 from .sources import _download_manifest
@@ -57,9 +63,10 @@ def bundle_update(
                 active_integration=detected if detected is not None else integration,
                 integration_explicit=bool(integration) and detected is None,
             )
-            install_bundle(
+            result = install_bundle(
                 project_root, plan, installer, manifest=manifest, refresh=True
             )
+            _render_install_warnings(result)
             console.print(
                 f"[green]✓[/green] Updated '{_escape_markup(str(target))}' "
                 f"to v{_escape_markup(str(plan.version))}."