diff --git a/README.md b/README.md
index 2f99e90..8540c90 100644
--- a/README.md
+++ b/README.md
@@ -492,6 +492,72 @@ The switch is never being polled when nobody is looking at the dashboard.
 
 ---
 
+## Firmware Upgrade
+
+The switch runs two software components that must both be upgraded:
+- **Diagnostic image** (diag) — upgraded first
+- **Agent image** (BOSS firmware) — upgraded second
+
+**Important rules:**
+- Upgrade one version at a time — cannot skip releases
+- Always upgrade the diagnostic image before the agent image
+- USB files must not be marked read-only or the transfer fails
+- Firmware downloads require an active support contract at the [Extreme Networks portal](https://extreme-networks.my.site.com)
+- Check the [ERS Announcements page](https://community.extremenetworks.com/t5/ers-announcements/bg-p/ERS_Announcements) to find the latest version
+
+Your switch currently runs: **BOSS v7.9.6.015 / Diagnostics 7.5.0.4**
+
+---
+
+### Method 1 — USB (no network needed, easiest)
+
+1. Download the diagnostic `.bin` and agent `.img` files from the Extreme portal
+2. Copy both files to a USB stick — ensure they are **not read-only**
+3. Insert the USB stick into the front panel USB port on the switch
+4. Via console or SSH (in enable mode):
+
+```
+download usb diag ers5900diag_7x_x_x_x.bin
+```
+Wait for it to complete and confirm, then:
+```
+download usb image ers5900_7x_x_x_x.img
+```
+The switch will reboot automatically after the agent upgrade.
+
+Alternatively, from the **boot menu** (option 4 — "Download Agent/Diag") you can trigger a USB download without logging in first.
+
+---
+
+### Method 2 — SFTP over SSH (requires network)
+
+From enable mode on the switch, with an SFTP server running on your management computer:
+
+```
+copy sftp address 192.168.99.50 filename ers5900diag_7x_x_x_x.bin
+```
+Wait for completion, then:
+```
+copy sftp address 192.168.99.50 filename ers5900_7x_x_x_x.img
+```
+The switch reboots after the agent upgrade.
+
+---
+
+### Method 3 — TFTP (requires TFTP server on management computer)
+
+Install a TFTP server (`sudo apt install tftpd-hpa`), place the firmware files in `/srv/tftp/`, then from enable mode:
+
+```
+copy tftp address 192.168.99.50 filename ers5900diag_7x_x_x_x.bin
+```
+Then:
+```
+copy tftp address 192.168.99.50 filename ers5900_7x_x_x_x.img
+```
+
+---
+
 ## Troubleshooting
 
 **Connection banner stuck on "Connecting..."**