> Offbrand POE+ switch firewalled at the router to avoid cloud, telemetry, and backdoor bullshit

How do you handle firmware updates for the devices connected to this vlan?