Agent question for patch 4165

[MNCowboy]

We currently are at VBR 12.3.2.3617 and applying the patch to 12.3.2.4165.

Our Agents are currently: Windows Agent 6.3.2.1205 and Linux Agent 6.3.2.1207

Since we are already at .3617, we will be using the exe to install the patch.

From the doco we have read, it looks like the Windows and Linux agents have to be updated separately.
Are the updated agents included in the exe? If so, where are they placed on the VBR server?

Or do we need to update every server separately? Download new version, put on remote server, run update from server.

We use Protection Groups, and previously we just do a rescan and the agent updates.
But where does the rescan get the new version from?

Thanks much