diff --git a/roles/restic/defaults/main.yaml b/roles/restic/defaults/main.yaml
index 2091ee4..7fdb13d 100644
--- a/roles/restic/defaults/main.yaml
+++ b/roles/restic/defaults/main.yaml
@@ -10,6 +10,7 @@ restic_checksum: sha256:a88ca09d1dd051d470965667a224a2b81930c6628a0566b7b17868be
 restic_bin_path: /usr/local/bin
 restic_etc_path: /etc/restic
 restic_path: "{{ restic_bin_path }}/restic"
+restic_self_update: true
 
 restic_global_exclude:
   - /dev
diff --git a/roles/restic/files/restic-tidy.sh b/roles/restic/files/restic-tidy.sh
index d7c0617..505f301 100755
--- a/roles/restic/files/restic-tidy.sh
+++ b/roles/restic/files/restic-tidy.sh
@@ -10,6 +10,11 @@ error_exit() {
 RESTIC_ETC_PATH=${RESTIC_ETC_PATH:-/etc/restic}
 RESTIC_PATH=${RESTIC_PATH:-/usr/local/bin/restic}
 
+if [ "$RESTIC_SELF_UPDATE" -eq 1 ]; then
+  printf "running restic self-update\n"
+  $RESTIC_PATH self-update
+fi
+
 # initial sleep
 MAX_ATTEMPTS=60
 MAX_SLEEP=43200  # 12 hours