diff --git a/README.md b/README.md
index 8133259..a8181f7 100644
--- a/README.md
+++ b/README.md
@@ -84,6 +84,14 @@ export KISS_RM=usr/share/doc:usr/share/gtk-doc:usr/share/info:usr/share/polkit-1
 # Set it to '1' to force.
 export KISS_FORCE=0
 
+# Show diff on system updates.
+#
+# This will spawn '$PAGER' (fallback to 'less') with a diff
+# of each changed file in the system update.
+#
+# Set it to '1' to enable.
+export KISS_AUDIT=0
+
 # Hook into kiss through a script.
 #
 # This can be used set custom CFLAGS per package, modify builds,
diff --git a/kiss b/kiss
index 30d158d..f829f2f 100755
--- a/kiss
+++ b/kiss
@@ -1034,6 +1034,11 @@ pkg_updates() {
     # shellcheck disable=2046,2086
     { IFS=:; set -- $KISS_PATH; IFS=$old_ifs; }
 
+    # Where to store repository diffs for the update.
+    # At the same time, create the file so updates requiring root don't
+    # overwrite the user's existing permissions over the log.
+    :> "$mak_dir/log"
+
     # Update each repository in '$KISS_PATH'. It is assumed that
     # each repository is 'git' tracked.
     for repo; do
@@ -1065,6 +1070,7 @@ pkg_updates() {
 
             if [ -w "$PWD" ] && [ "$(id -u)" != 0 ]; then
                 git fetch
+                git diff >> "$mak_dir/log"
                 git merge
 
             else
@@ -1078,12 +1084,15 @@ pkg_updates() {
                 # case that the repository is owned by a 3rd user.
                 (
                     user=$(stat -c %U "$PWD")
+                    pull="git fetch && git diff >>'$mak_dir/log' && git merge"
 
                     [ "$user" = root ] ||
                         log "Dropping permissions to $user for pull"
 
-                    as_root git fetch
-                    as_root git merge
+                    case $su in
+                        su) as_root       "$pull" ;;
+                        *)  as_root sh -c "$pull" ;;
+                    esac
                 )
             fi
         }
@@ -1136,6 +1145,11 @@ pkg_updates() {
 
     log "Packages to update: ${outdated% }"
 
+    # Show a diff of each new change to the repositories.
+    # This spawns the user's set PAGER with a fallback to less.
+    [ -s "$mak_dir/log" ] && [ "$KISS_AUDIT" = 1 ] &&
+        "${PAGER:-less}" "$mak_dir/log"
+
     # Tell 'pkg_build' to always prompt before build.
     pkg_update=1
 
diff --git a/kiss.1 b/kiss.1
index 8c17310..53d3213 100644
--- a/kiss.1
+++ b/kiss.1
@@ -63,6 +63,14 @@ export KISS_RM=usr/share/doc:usr/share/gtk-doc:usr/share/info:usr/share/polkit-1
 # Set it to '1' to force.
 export KISS_FORCE=0
 
+# Show diff on system updates.
+#
+# This will spawn '$PAGER' (fallback to 'less') with a diff
+# of each changed file in the system update.
+#
+# Set it to '1' to enable.
+export KISS_AUDIT=0
+
 # Hook into kiss through a script.
 #
 # This can be used set custom CFLAGS per package, modify builds,