A software upgrade to be deployed by a cloud extension agent is received by a remote network management platform, the cloud extension agent running locally on a network and initiating an outbound connection to the remote network management platform through a firewall of the network. A command is generated for the software upgrade, the command comprising an identification of a source of the software upgrade. The command is provided to the cloud extension agent, wherein providing the command causes the cloud extension agent to acquire the software upgrade from the identified source and deploy the software upgrade.