Install the latest version of Access Gateway

Upgrade an Access Gateway node to the latest version from the Management console.

Before you begin

Don't resize your terminal window during the upgrade process. Resizing the window below 80x24 may interrupt the upgrade process.
The Access Gateway admin node must be able to reach your org URL at <your-org>-admin.okta.com. Verify that it's excluded from SSL decryption. See Access Gateway deployment prerequisites.
If you're upgrading from any version, upgrade the admin node after you've upgraded all worker nodes.
If you're upgrading from version 2024.6.1 or earlier, see How to upgrade Access Gateway from versions 2024.6.1 and earlier.
If you're upgrading from version 2024.7.0 or earlier, upgrade all of your nodes in the same maintenance window. This ensures that all app configurations are updated after the PHP upgrade. If you can't upgrade all of your nodes at the same time, see this Okta Support article.
If you have a scheduled AutoUpdate configured, complete step 5 from the installation procedure on all nodes before the scheduled time.

Procedure

Take a snapshot of the appliance or make a backup before you start the upgrade process.

See your virtualization platform's documentation for instructions on how to take snapshots. See Backup and restore.
Sign in to the Access Gateway Management console.
Install the required okta-mgmt-user package.
This step is required in one of the following cases:
- You enabled Federal Information Processing Standards (FIPS) mode and you're running Access Gateway version 2026.3.0 or earlier. In this case, use package okta-mgmt-user-2026.3.0-23e5552d4.
- FIPS isn't enabled and you're running Access Gateway version 2023.7.2 or earlier. In this case, use package okta-mgmt-user-2023.9.1-64a0a16e6.
For all other versions and configurations, skip to step 4.
1. Select 5 - System > 2 - Install Package.
2. When prompted, enter the correct package name (as indicated previously) and press Enter.
3. When the upgrade is complete, close the Management console.
4. Open the Management console and sign in again.
Install the okta-release-2025.3.1-a01a66b3d package.

This step is required only if you're running Access Gateway version 2025.1.1 or earlier. If your Access Gateway version is 2025.3.1 or later, skip to step 5.
1. Select 5 - System > 2 - Install Package.
2. When the installer prompts you for a package name, enter okta-release-2025.3.1-a01a66b3d and press Enter.
Install the okta-release-2026.5.1-73c148ab1 package.

This step is required only if you're running Access Gateway version 2026.4.0 or earlier. If your Access Gateway version is 2026.5.1 or later, skip to step 6.
1. Select 5 - System > 2 - Install Package.
2. When the installer prompts you for a package name, enter okta-release-2026.5.1-73c148ab1 and press Enter.
Select 5 - System > 4 - Update and follow the prompts to update the remaining Access Gateway packages.
Note:
The Upgrade in-progress page may appear blank after the upgrade has finished. If this happens, validate the upgrade:
1. Press CTRL+C on your keyboard to return to the previous page. It may show an upgrade failure message.
2. Sign in to Shell and run the following command:
```
sudo tail -1 /opt/oag/upgrades/current/yumUpdateOutput.log
```
  Shell displays Complete! when the upgrade finishes successfully.
3. Follow the remaining steps in the installation instructions.
Reboot the node after you complete the upgrade.

See the Reboot section of the System menu for instructions. The app update process starts after the reboot. See How to check if application update is in progress post-upgrade.
Clear the browser cookies from the client computer.

Do this before you access the Access Gateway Admin UI console after rebooting.
Enable trusted domains on admin nodes if it isn't already.

If you don't enable this option, Single Logout fails. See the Manage Trusted Domains section of the Access Gateway Network Setup menu.