diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6339099..9c30b99 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,8 @@ first public release
 ### Recent Fixes
 
 - **utmpx time field portability** — replaced hardcoded `C.__uint32_t` / `C.__int32_t` casts with a C helper function (`auth/utmpx_time.h`) that lets the compiler handle type conversion. fixes build failure on systems where `ut_tv` uses `struct timeval` instead of the 32/64 compat struct
+- **cgo pointer safety for pam** — replaced `unsafe.Pointer(&h)` (Go stack pointer passed to C) with `storeHandle`/`loadHandle` helpers that keep the `cgo.Handle` in C-heap memory. fixes `cgo argument has Go pointer to unpinned Go pointer` panic on Go 1.22+
+- **missing `extra/` directory** — added `extra/config.toml`, `extra/xsetup.sh`, `extra/lemurs.pam`, and `extra/lemurs.service` so `make install` can find them
 - **makefile `deps` target** — added `make deps` to automatically install `libpam0g-dev` and `build-essential`, and verify go is present
 - **readme overhaul** — rewrote for clarity: added "what problem does this solve", "how it works", known issues, simpler install instructions, and proper dependency listing
 
diff --git a/Makefile b/Makefile
index c85fb4c..3b28dd9 100644
--- a/Makefile
+++ b/Makefile
@@ -34,7 +34,7 @@ RST       := \033[0m
 ##  ─── targets ────────────────────────────────────────────────
 
 .PHONY: all deps build install uninstall clean test lint fmt vet \
-        run-preview release help
+        run-preview release enable update help
 
 deps:  ## install system dependencies
 	@printf "  $(BLUE)%-10s$(RST) checking dependencies...\n" "DEPS"
@@ -112,6 +112,29 @@ release: clean  ## build with version info
 	@printf "\n"
 	@$(MAKE) build
 
+enable:  ## disable other DM + enable latchd
+	@printf "  $(YELLOW)%-10s$(RST) switching to latchd...\n" "ENABLE"
+	@if systemctl is-active display-manager.service >/dev/null 2>&1; then \
+		printf "  $(DIM)%-10s$(RST) stopping current display manager\n" ""; \
+		sudo systemctl stop display-manager.service; \
+	fi
+	@if [ -L /etc/systemd/system/display-manager.service ] \
+		&& ! readlink /etc/systemd/system/display-manager.service | grep -q $(BINARY); then \
+		printf "  $(DIM)%-10s$(RST) disabling aliased display manager\n" ""; \
+		sudo systemctl disable display-manager.service; \
+	fi
+	@sudo systemctl enable $(BINARY).service
+	@printf "  $(GREEN)%-10s$(RST) latchd enabled — reboot or run 'sudo systemctl start latchd'\n" "ENABLE"
+
+update:  ## uninstall → git pull → rebuild → reinstall
+	@printf "  $(YELLOW)%-10s$(RST) removing previous install...\n" "UPDATE"
+	@sudo $(MAKE) uninstall
+	@printf "  $(CYAN)%-10s$(RST) pulling latest...\n" "UPDATE"
+	@git pull
+	@printf "  $(BLUE)%-10s$(RST) rebuilding...\n" "UPDATE"
+	@sudo $(MAKE) install
+	@printf "  $(GREEN)%-10s$(RST) updated — run 'sudo make enable' to switch DMs\n" "UPDATE"
+
 help:  ## print this help
 	@printf "  $(BOLD)latchd$(RST) — tui display manager\n"
 	@printf "  $(DIM)version $(VERSION)  commit $(COMMIT)$(RST)\n"