diff --git a/CHANGELOG.md b/CHANGELOG.md
index 99b793f7..6ac5c4d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,10 +20,14 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 ### Fixed
 
+- Command line option `--update` when the `dns.serve_plain_dns` configuration property was disabled ([7801]).
+
 - DNS cache not working for custom upstream configurations.
 
 - Validation process for the DNS-over-TLS, DNS-over-QUIC, and HTTPS ports on the *Encryption Settings* page.
 
+[#7801]: https://github.com/AdguardTeam/AdGuardHome/issues/7801
+
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
 -->
diff --git a/internal/home/dns.go b/internal/home/dns.go
index eff257d1..9afc6263 100644
--- a/internal/home/dns.go
+++ b/internal/home/dns.go
@@ -119,16 +119,15 @@ func initDNS(
 		globalContext.dhcpServer,
 		anonymizer,
 		httpRegister,
-		tlsMgr.config(),
 		tlsMgr,
 		baseLogger,
 	)
 }
 
 // initDNSServer initializes the [context.dnsServer].  To only use the internal
-// proxy, none of the arguments are required, but tlsConf, tlsMgr and l still
-// must not be nil, in other cases all the arguments also must not be nil.  It
-// also must not be called unless [config] and [globalContext] are initialized.
+// proxy, none of the arguments are required, but tlsMgr and l still must not be
+// nil, in other cases all the arguments also must not be nil.  It also must not
+// be called unless [config] and [globalContext] are initialized.
 //
 // TODO(e.burkov): Use [dnsforward.DNSCreateParams] as a parameter.
 func initDNSServer(
@@ -138,7 +137,6 @@ func initDNSServer(
 	dhcpSrv dnsforward.DHCP,
 	anonymizer *aghnet.IPMut,
 	httpReg aghhttp.RegisterFunc,
-	tlsConf *tlsConfigSettings,
 	tlsMgr *tlsManager,
 	l *slog.Logger,
 ) (err error) {
@@ -167,7 +165,7 @@ func initDNSServer(
 	dnsConf, err := newServerConfig(
 		&config.DNS,
 		config.Clients.Sources,
-		tlsConf,
+		tlsMgr.config(),
 		tlsMgr,
 		httpReg,
 		globalContext.clients.storage,
diff --git a/internal/home/home.go b/internal/home/home.go
index dc5055d5..a4e847bf 100644
--- a/internal/home/home.go
+++ b/internal/home/home.go
@@ -1078,7 +1078,7 @@ func cmdlineUpdate(
 	//
 	// TODO(e.burkov):  We could probably initialize the internal resolver
 	// separately.
-	err := initDNSServer(nil, nil, nil, nil, nil, nil, &tlsConfigSettings{}, tlsMgr, l)
+	err := initDNSServer(nil, nil, nil, nil, nil, nil, tlsMgr, l)
 	fatalOnError(err)
 
 	l.InfoContext(ctx, "performing update via cli")
diff --git a/internal/home/tls.go b/internal/home/tls.go
index cb52403a..058a4ba0 100644
--- a/internal/home/tls.go
+++ b/internal/home/tls.go
@@ -193,7 +193,10 @@ func (m *tlsManager) start(_ context.Context) {
 	m.web.tlsConfigChanged(context.Background(), m.conf)
 }
 
-// reload updates the configuration and restarts the TLS manager.
+// reload updates the configuration and restarts the TLS manager.  It logs any
+// encountered errors.
+//
+// TODO(s.chzhen):  Consider returning an error.
 func (m *tlsManager) reload(ctx context.Context) {
 	m.mu.Lock()
 	defer m.mu.Unlock()