diff --git a/RoboFile.php b/RoboFile.php
index b17bcab5..ba1a679b 100644
--- a/RoboFile.php
+++ b/RoboFile.php
@@ -34,6 +34,28 @@ public function filesPush(string $destination, $options = ['exclude' => null, 'd
         return $this->rsyncPush("{$destination}:%files", $options);
     }
 
+    /**
+     * Pull plugins directory from remote to local.
+     *
+     * @param  string  $source  Source alias eg. `production`
+     * @return \Robo\Result
+     */
+    public function pluginsPull(string $source, $options = ['exclude' => null, 'dry-run' => false, 'options' => null])
+    {
+        return $this->rsyncPull("{$source}:web/app/plugins/", $options);
+    }
+
+    /**
+     * Push uploads directory from local to remote.
+     *
+     * @param  string  $destination  Destination alias eg. `production`
+     * @return \Robo\Result
+     */
+    public function pluginsPush(string $destination, $options = ['exclude' => null, 'dry-run' => true, 'options' => null])
+    {
+        return $this->rsyncPush("{$destination}:web/app/plugins/", $options);
+    }
+
     // You can override common tasks by overloading their functions in this file. Eg.
     //
     //   public function buildDevelopment($options = ['npm-script' => 'build'])
diff --git a/config/application.php b/config/application.php
index 7c7b90ee..dad3960f 100644
--- a/config/application.php
+++ b/config/application.php
@@ -121,14 +121,15 @@
 /**
  * Custom Settings
  */
+// Set to false to manage updates in WordPress and edit deploy.php
 Config::define('AUTOMATIC_UPDATER_DISABLED', true);
 defined('DISABLE_WP_CRON') or Config::define('DISABLE_WP_CRON', env('DISABLE_WP_CRON') ?: false);
 Config::define('WP_POST_REVISIONS', 10);
 Config::define('WP_DEFAULT_THEME', 'gds');
 // Disable the plugin and theme file editor in the admin
-Config::define('DISALLOW_FILE_EDIT', true);
+Config::define('DISALLOW_FILE_EDIT', Config::get('AUTOMATIC_UPDATER_DISABLED'));
 // Disable plugin and theme updates and installation from the admin
-Config::define('DISALLOW_FILE_MODS', true);
+Config::define('DISALLOW_FILE_MODS', Config::get('AUTOMATIC_UPDATER_DISABLED'));
 // Avoid using event attempting FTP updates
 Config::define('FS_METHOD', 'direct');
 // Disable ACF Admin UI when in production
diff --git a/deploy.php b/deploy.php
index 7c3022db..e55b3a12 100644
--- a/deploy.php
+++ b/deploy.php
@@ -24,7 +24,12 @@
 set('ssh_multiplexing', true);
 
 set('shared_files', ['.env']);
-set('shared_dirs', ['web/app/uploads']);
+set('shared_dirs', [
+    'web/app/uploads',
+    // @note allow WordPress to manage updates
+    // 'web/wp',
+    // 'web/app/plugins',
+]);
 set('writable_dirs', ['web/app/cache', ...get('shared_dirs')]);
 set('writable_mode', 'chmod');
 set('writable_use_sudo', false);
@@ -67,6 +72,10 @@
     '/*.php',
     '/*.xml',
     '/*.yml',
+    // @note to allow automatically updated plugins, uncomment this after the
+    // first deploy
+    // '/web/wp',
+    // '/web/app/plugins',
 ]);
 
 /**