diff --git a/scripts/CHANGELOG.md b/scripts/CHANGELOG.md
index 31d73aa..06a7b62 100644
--- a/scripts/CHANGELOG.md
+++ b/scripts/CHANGELOG.md
@@ -15,6 +15,10 @@ hub-vouched artifact manifest** before installing/using it. BUNDLE slice; pairs
   `0755 /usr/local/bin/felhom-agent`; ensures the non-root `felhom-agent` system user; installs the
   canonical sudoers (`0440`, `visudo -cf`-validated) + systemd unit; `daemon-reload` + enable. Idempotent:
   same version already installed + service active → skip.
+- **`--skip-provision`:** install + configure + verify the agent (incl. golden fetch+verify) but do NOT
+  provision a guest — the agent-only path for re-installing/upgrading the agent on a host that already
+  has live guests. Adds an agent-only `step_verify_agent` (binary + non-root service active + a
+  `--selftest=hub` collect-report).
 - **New step `7/8 golden`:** local auto-discovery stays the default/fallback; otherwise fetches
   `/api/packages/admin/generic/felhom-golden/<ver>/golden.tar.zst`, **verifies sha256**, and imports it
   into the archive storage's dump dir for the restore. `--force-gitea-golden` forces the Gitea path.
diff --git a/scripts/felhom-host-install.sh b/scripts/felhom-host-install.sh
index e4b19d0..9f6c6db 100644
--- a/scripts/felhom-host-install.sh
+++ b/scripts/felhom-host-install.sh
@@ -48,6 +48,9 @@
 #   --preserve-from PATH    merge non-Day-0 sections (privileged/storage/backup/
 #                           local_api/authz/lan_resolver) from an existing config
 #   --force                 allow provisioning over an EXISTING vmid (destructive)
+#   --skip-provision        install + configure + verify the agent, but do NOT
+#                           provision a guest (re-install/upgrade an agent on a host
+#                           that already has live guests; also the agent-only path)
 #   --dry-run               print every mutating command without executing
 #   --resume                skip steps already recorded in the state file
 #   -h, --help              this help
@@ -98,6 +101,7 @@ PASSPHRASE_FILE=""
 PRESERVE_FROM=""
 FORCE=false
 FORCE_GITEA_GOLDEN=false
+SKIP_PROVISION=false
 DRY_RUN=false
 RESUME=false
 
@@ -240,6 +244,7 @@ while [[ $# -gt 0 ]]; do
         --preserve-from)   PRESERVE_FROM="$2"; shift 2 ;;
         --force)           FORCE=true; shift ;;
         --force-gitea-golden) FORCE_GITEA_GOLDEN=true; shift ;;
+        --skip-provision)  SKIP_PROVISION=true; shift ;;
         --dry-run)         DRY_RUN=true; shift ;;
         --resume)          RESUME=true; shift ;;
         -h|--help)         usage ;;
@@ -366,8 +371,10 @@ step_preflight() {
         log_info "  golden: none local — will fetch + verify from Gitea in step 7/8"
     fi
 
-    # vmid guard
-    if pct status "$VMID" >/dev/null 2>&1; then
+    # vmid guard (irrelevant when --skip-provision: we never touch a guest)
+    if $SKIP_PROVISION; then
+        log_info "  --skip-provision: agent install/config only, no guest will be provisioned"
+    elif pct status "$VMID" >/dev/null 2>&1; then
         if $FORCE; then
             log_warn "  vmid $VMID already exists — --force given, it WILL be destroyed by provision"
         else
@@ -779,6 +786,31 @@ step_verify() {
     fi
 }
 
+#-------------------------------------------------------------------------------
+# verify (agent-only, for --skip-provision): the agent is installed, runs non-root, and reports.
+#-------------------------------------------------------------------------------
+step_verify_agent() {
+    log_step "verify (agent only)"
+    if $DRY_RUN; then log_dry "felhom-agent --version; systemctl is-active felhom-agent; --selftest=hub (one collect+report)"; return 0; fi
+    local ok=true
+    log_info "  binary: $("$AGENT_BIN" --version 2>&1 | head -1)"
+    log_info "  runs as: $(systemctl show felhom-agent -p User --value 2>/dev/null) (want $AGENT_USER)"
+    if systemctl is-active --quiet felhom-agent; then log_success "  service active"; else log_error "  service NOT active"; ok=false; fi
+    # one explicit collect+report to prove the hub link end-to-end (host-report lands).
+    if felhom-agent --config "$AGENT_CONFIG" --selftest=hub >/dev/null 2>&1; then
+        log_success "  --selftest=hub OK (a host-report reached the hub)"
+    else
+        log_warn "  --selftest=hub did not confirm (the daemon loop still reports every poll_seconds)"
+    fi
+    _state_mark verify
+    echo ""
+    if $ok; then
+        log_success "Agent install SUCCESS — $("$AGENT_BIN" --version 2>&1 | head -1) as $AGENT_USER, host_id=$HOST_ID customer=$CUSTOMER_ID"
+    else
+        log_warn "Agent install completed WITH WARNINGS — review the checks above"
+    fi
+}
+
 #-------------------------------------------------------------------------------
 # Main
 #-------------------------------------------------------------------------------
@@ -806,5 +838,10 @@ should_skip enroll        || step_enroll
 should_skip agent_install || step_agent_install
 should_skip agent_config  || step_agent_config
 should_skip golden        || step_golden
-should_skip provision     || step_provision
-step_verify
+if $SKIP_PROVISION; then
+    log_skip "provision (--skip-provision) — agent install/config verified only"
+    step_verify_agent
+else
+    should_skip provision || step_provision
+    step_verify
+fi