diff --git a/internal/devbox/update.go b/internal/devbox/update.go
index acd6592a529..5b991ae25a7 100644
--- a/internal/devbox/update.go
+++ b/internal/devbox/update.go
@@ -85,15 +85,24 @@ func (d *Devbox) Update(ctx context.Context, opts devopt.UpdateOpts) error {
 		return err
 	}
 
-	// I'm not entirely sure this is even needed, so ignoring the error.
-	// It's definitely not needed for non-flakes. (which is 99.9% of packages)
-	// It will return an error if .devbox/gen/flake is missing
-	// TODO: Remove this if it's not needed.
-	_ = nix.FlakeUpdate(shellgen.FlakePath(d))
-
-	// fix any missing store paths.
-	if err = d.FixMissingStorePaths(ctx); err != nil {
-		return errors.WithStack(err)
+	// With --no-install, skip the two post-update steps that shell out to Nix:
+	// "nix flake update" (via FlakeUpdate) and "nix path-info" (via
+	// FixMissingStorePaths). This keeps `devbox update --no-install` usable in
+	// environments where Nix isn't fully set up (e.g. CI/Renovate), where those
+	// calls would otherwise fail. Earlier steps in the update flow may still
+	// resolve flake refs via Nix; --no-install only avoids these install-like
+	// steps. See jetify-com/devbox#2585.
+	if !opts.NoInstall {
+		// I'm not entirely sure this is even needed, so ignoring the error.
+		// It's definitely not needed for non-flakes. (which is 99.9% of packages)
+		// It will return an error if .devbox/gen/flake is missing
+		// TODO: Remove this if it's not needed.
+		_ = nix.FlakeUpdate(shellgen.FlakePath(d))
+
+		// fix any missing store paths.
+		if err = d.FixMissingStorePaths(ctx); err != nil {
+			return errors.WithStack(err)
+		}
 	}
 
 	return plugin.Update()
diff --git a/testscripts/update/update.test.txt b/testscripts/update/update.test.txt
index 8c9169df8af..156db22ae3d 100644
--- a/testscripts/update/update.test.txt
+++ b/testscripts/update/update.test.txt
@@ -4,6 +4,11 @@ exec devbox install
 
 exec devbox update
 
+# `devbox update --no-install` must not run the post-update "nix flake update"
+# step. Regression test for #2585.
+exec devbox update --no-install
+! stderr 'nix flake update'
+
 -- devbox.json --
 {
   "packages": [