[update] Hide update URLs behind redirect