Techniques for updating a client device are provided that include receiving, by a client device, a software update and a certificate associated with the software update, verifying, by the client device, the certificate associated with the software update based on a stored public key of the client device, extracting an update scope value from the certificate, comparing the update scope value against a corresponding attribute of the update, and either applying the software update based on the comparing, or rejecting the software update based on the comparing.