diff --git a/update-submodules.sh b/update-submodules.sh
new file mode 100755
index 0000000..c852477
--- /dev/null
+++ b/update-submodules.sh
@@ -0,0 +1,71 @@
+#!/bin/sh
+# Update mars-nwe submodules without accidentally advancing pinned nested
+# submodules such as third_party/libsodium/libsodium.
+#
+# Default mode:
+#   - update only the top-level submodules listed in this repository's
+#     .gitmodules using --remote --merge;
+#   - then run a normal recursive init/update so nested submodules are checked
+#     out at the commits pinned by their parent submodule, not at their remotes.
+#
+# Use --init-only to skip remote updates and just restore the pinned tree.
+
+set -eu
+
+usage() {
+    cat <<'USAGE'
+Usage: ./update-submodules.sh [--init-only]
+
+  --init-only   Do not fetch/merge remote branches for top-level submodules;
+                only initialize/update everything to the commits pinned by the
+                current superproject and submodules.
+
+This script intentionally does not run:
+  git submodule update --remote --merge --recursive
+
+That command would also try to advance nested submodules, e.g.
+third_party/libsodium/libsodium, even though mars-nwe pins it to a specific
+libsodium release commit.
+USAGE
+}
+
+init_only=0
+case "${1:-}" in
+    "") ;;
+    --init-only) init_only=1 ;;
+    -h|--help) usage; exit 0 ;;
+    *) usage >&2; exit 2 ;;
+esac
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+cd "$script_dir"
+
+if [ ! -f .gitmodules ]; then
+    echo "error: .gitmodules not found; run this from the mars-nwe root" >&2
+    exit 1
+fi
+
+# First make sure the top-level submodule working trees exist.
+git submodule update --init
+
+if [ "$init_only" -eq 0 ]; then
+    echo "Updating top-level submodules from their configured remotes..."
+    git config --file .gitmodules --get-regexp '^submodule\..*\.path$' |
+    while read -r _key path; do
+        case "$path" in
+            "") continue ;;
+        esac
+        echo "==> $path"
+        git submodule update --remote --merge -- "$path"
+    done
+else
+    echo "Skipping remote updates; restoring pinned submodule commits only."
+fi
+
+# Now update nested submodules only to their pinned commits.  This is what keeps
+# third_party/libsodium/libsodium on the release selected by mars-libsodium.
+echo "Synchronizing nested submodules to pinned commits..."
+git submodule update --init --recursive
+
+echo "Current recursive submodule status:"
+git submodule status --recursive