diff --git a/hub/route/server.go b/hub/route/server.go
index 21102cc3..3c3e5ca4 100644
--- a/hub/route/server.go
+++ b/hub/route/server.go
@@ -127,10 +127,10 @@ func router(isDebug bool, secret string, dohServer string, cors Cors) *chi.Mux {
 		r.Mount("/providers/rules", ruleProviderRouter())
 		r.Mount("/cache", cacheRouter())
 		r.Mount("/dns", dnsRouter())
-		if !embedMode { // disallow restart and upgrade in embed mode
+		if !embedMode { // disallow restart in embed mode
 			r.Mount("/restart", restartRouter())
-			r.Mount("/upgrade", upgradeRouter())
 		}
+		r.Mount("/upgrade", upgradeRouter())
 		addExternalRouters(r)
 
 	})
diff --git a/hub/route/upgrade.go b/hub/route/upgrade.go
index 2fed3f67..beee77a2 100644
--- a/hub/route/upgrade.go
+++ b/hub/route/upgrade.go
@@ -14,9 +14,11 @@ import (
 
 func upgradeRouter() http.Handler {
 	r := chi.NewRouter()
-	r.Post("/", upgradeCore)
 	r.Post("/ui", updateUI)
-	r.Post("/geo", updateGeoDatabases)
+	if !embedMode { // disallow upgrade core/geo in embed mode
+		r.Post("/", upgradeCore)
+		r.Post("/geo", updateGeoDatabases)
+	}
 	return r
 }