diff --git a/api/src/lib.rs b/api/src/lib.rs
index f71dc98..3eb939a 100644
--- a/api/src/lib.rs
+++ b/api/src/lib.rs
@@ -851,6 +851,8 @@ pub trait Store {
     fn account(&self, name: &str) -> Option<AccountView>;
     // Canonical account name for a nick (following a grouping), if registered.
     fn resolve_account(&self, name: &str) -> Option<&str>;
+    /// Registered accounts whose name matches `pattern` (a glob), for oper LIST.
+    fn accounts_matching(&self, pattern: &str) -> Vec<AccountView>;
     // The canonical account name if the password is correct, else None.
     fn authenticate(&self, name: &str, password: &str) -> Option<&str>;
     fn grouped_nicks(&self, account: &str) -> Vec<String>;
diff --git a/modules/nickserv/src/lib.rs b/modules/nickserv/src/lib.rs
index a4fb822..7659185 100644
--- a/modules/nickserv/src/lib.rs
+++ b/modules/nickserv/src/lib.rs
@@ -32,6 +32,10 @@ mod resetpass;
 mod confirm;
 #[path = "ajoin.rs"]
 mod ajoin;
+#[path = "update.rs"]
+mod update;
+#[path = "list.rs"]
+mod list;
 #[path = "suspend.rs"]
 mod suspend;
 mod noexpire;
@@ -56,6 +60,8 @@ const TOPICS: &[HelpEntry] = &[
     HelpEntry { cmd: "DROP", summary: "delete your account", detail: "Syntax: \x02DROP <password>\x02\nDeletes your account and releases the channels you founded." },
     HelpEntry { cmd: "CERT", summary: "manage SASL EXTERNAL certs", detail: "Syntax: \x02CERT ADD <password> [fingerprint]\x02, \x02CERT DEL <fingerprint>\x02, \x02CERT LIST\x02\nManages the TLS certificate fingerprints that can log in via SASL EXTERNAL." },
     HelpEntry { cmd: "AJOIN", summary: "auto-join channels on login", detail: "Syntax: \x02AJOIN ADD <#channel>\x02, \x02AJOIN DEL <#channel>\x02, \x02AJOIN LIST\x02\nChannels you are auto-joined to when you identify." },
+    HelpEntry { cmd: "UPDATE", summary: "refresh your session", detail: "Syntax: \x02UPDATE\x02\nRe-applies your auto-joins and vhost and re-checks for new memos." },
+    HelpEntry { cmd: "LIST", summary: "list accounts (oper)", detail: "Syntax: \x02LIST <pattern>\x02\nLists registered accounts matching a glob. Requires the auspex privilege." },
     HelpEntry { cmd: "SUSPEND", summary: "block an account (operator)", detail: "Syntax: \x02SUSPEND <account> [reason]\x02\nBlocks an account from logging in. Operators only." },
     HelpEntry { cmd: "UNSUSPEND", summary: "lift a suspension (operator)", detail: "Syntax: \x02UNSUSPEND <account>\x02\nLifts a suspension. Operators only." },
     HelpEntry { cmd: "NOEXPIRE", summary: "pin against expiry (operator)", detail: "Syntax: \x02NOEXPIRE <account> {ON|OFF}\x02\nPins an account so inactivity expiry never drops it. Operators only." },
@@ -115,6 +121,8 @@ impl Service for NickServ {
             Some("SUSPEND") => suspend::handle(me, from, args, ctx, net, db, true),
             Some("UNSUSPEND") => suspend::handle(me, from, args, ctx, net, db, false),
             Some("NOEXPIRE") => noexpire::handle(me, from, args, ctx, db),
+            Some("UPDATE") => update::handle(me, from, ctx, db),
+            Some("LIST") => list::handle(me, from, args, ctx, db),
             Some("HELP") => echo_api::help(me, from, ctx, BLURB, TOPICS, args.get(1).copied()),
             Some(other) => ctx.notice(me, from.uid, format!("I don't know the command \x02{other}\x02. Try \x02HELP\x02.")),
             None => {}
diff --git a/modules/nickserv/src/list.rs b/modules/nickserv/src/list.rs
new file mode 100644
index 0000000..0e6e2fe
--- /dev/null
+++ b/modules/nickserv/src/list.rs
@@ -0,0 +1,23 @@
+use echo_api::{human_time, Priv, Sender, ServiceCtx, Store};
+
+// A cap so a broad glob can't flood the requesting oper.
+const MAX_SHOWN: usize = 100;
+
+// LIST <pattern>: list registered accounts matching a glob. Oper-only.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &dyn Store) {
+    if !from.privs.has(Priv::Auspex) {
+        ctx.notice(me, from.uid, "Access denied — LIST needs the \x02auspex\x02 privilege.");
+        return;
+    }
+    let pattern = args.get(1).copied().unwrap_or("*");
+    let mut matches = db.accounts_matching(pattern);
+    matches.sort_by_key(|a| a.name.to_ascii_lowercase());
+
+    ctx.notice(me, from.uid, format!("Accounts matching \x02{pattern}\x02:"));
+    for a in matches.iter().take(MAX_SHOWN) {
+        let flag = if a.verified { "" } else { " (unconfirmed)" };
+        ctx.notice(me, from.uid, format!("  \x02{}\x02  registered {}{}", a.name, human_time(a.ts), flag));
+    }
+    let more = if matches.len() > MAX_SHOWN { format!(", showing the first {MAX_SHOWN}") } else { String::new() };
+    ctx.notice(me, from.uid, format!("End of list — {} match(es){more}.", matches.len()));
+}
diff --git a/modules/nickserv/src/update.rs b/modules/nickserv/src/update.rs
new file mode 100644
index 0000000..e6230b8
--- /dev/null
+++ b/modules/nickserv/src/update.rs
@@ -0,0 +1,21 @@
+use echo_api::{Sender, ServiceCtx, Store};
+
+// UPDATE: re-apply your account's auto-joins and vhost, and re-check for waiting
+// memos, without having to re-identify.
+pub fn handle(me: &str, from: &Sender, ctx: &mut ServiceCtx, db: &dyn Store) {
+    let Some(account) = from.account else {
+        ctx.notice(me, from.uid, "You need to be logged in. Identify to NickServ first.");
+        return;
+    };
+    for entry in db.ajoin_list(account) {
+        ctx.force_join(from.uid, &entry.channel, &entry.key);
+    }
+    if let Some(v) = db.vhost(account) {
+        ctx.apply_vhost(from.uid, &v.host);
+    }
+    let unread = db.unread_memos(account);
+    if unread > 0 {
+        ctx.notice(me, from.uid, format!("You have \x02{unread}\x02 new memo(s). Read them with \x02/msg MemoServ READ NEW\x02."));
+    }
+    ctx.notice(me, from.uid, "Your status has been refreshed.");
+}
diff --git a/src/engine/db/store.rs b/src/engine/db/store.rs
index 43e161c..3a7475d 100644
--- a/src/engine/db/store.rs
+++ b/src/engine/db/store.rs
@@ -16,6 +16,12 @@ impl Store for Db {
     fn resolve_account(&self, name: &str) -> Option<&str> {
         Db::resolve_account(self, name)
     }
+    fn accounts_matching(&self, pattern: &str) -> Vec<AccountView> {
+        self.accounts()
+            .filter(|a| super::glob_match(pattern, &a.name))
+            .map(|a| AccountView { name: a.name.clone(), email: a.email.clone(), ts: a.ts, verified: a.verified, greet: a.greet.clone() })
+            .collect()
+    }
     fn authenticate(&self, name: &str, password: &str) -> Option<&str> {
         Db::authenticate(self, name, password)
     }
diff --git a/src/engine/tests.rs b/src/engine/tests.rs
index 928bb6d..ab36af3 100644
--- a/src/engine/tests.rs
+++ b/src/engine/tests.rs
@@ -776,6 +776,37 @@
         assert!(out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains("isn't registered"))), "unknown channel refused: {out:?}");
     }
 
+    // NickServ LIST is auspex-gated and glob-matches; UPDATE refreshes a session.
+    #[test]
+    fn nickserv_list_and_update() {
+        use echo_nickserv::NickServ;
+        let path = std::env::temp_dir().join("echo-nslistupd.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.scram_iterations = 4096;
+        db.register("staff", "password1", None).unwrap();
+        db.register("alice", "pw", None).unwrap();
+        db.register("albert", "pw", None).unwrap();
+        let mut e = Engine::new(vec![Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 })], db);
+        let mut opers = std::collections::HashMap::new();
+        opers.insert("staff".to_string(), Privs::default().with(echo_api::Priv::Auspex));
+        e.set_opers(opers);
+        let ns = |e: &mut Engine, uid: &str, t: &str| e.handle(NetEvent::Privmsg { from: uid.into(), to: "42SAAAAAA".into(), text: t.into() });
+        let notice = |out: &[NetAction], n: &str| out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains(n)));
+
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAC".into(), nick: "staff".into(), host: "h".into(), ip: "0.0.0.0".into() });
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "rando".into(), host: "h".into(), ip: "0.0.0.0".into() });
+
+        assert!(notice(&ns(&mut e, "000AAAAAB", "LIST *"), "Access denied"), "non-oper LIST refused");
+        e.handle(NetEvent::Privmsg { from: "000AAAAAC".into(), to: "42SAAAAAA".into(), text: "IDENTIFY password1".into() });
+        let out = ns(&mut e, "000AAAAAC", "LIST al*");
+        assert!(notice(&out, "alice") && notice(&out, "albert"), "LIST al* shows the matches: {out:?}");
+        assert!(!notice(&out, "\x02staff\x02"), "LIST al* excludes non-matches: {out:?}");
+
+        let out = ns(&mut e, "000AAAAAC", "UPDATE");
+        assert!(notice(&out, "refreshed"), "UPDATE confirms: {out:?}");
+    }
+
     // BotServ BOT ADD/LIST is oper-gated (Priv::Admin) and the bot is remembered.
     #[test]
     fn botserv_bot_add_list_is_oper_gated() {