○ Updated to include safety results from the recent Phase 2b atopic dermatitis study and Phase 3 rheumatoid arthritis studies. ○ Updated biomarker sample language for clarification. ○ Added rationale for selection of doses for adolescents and recent efficacy and safety data from the Phase 2b study to justify dose selection. ○ Updated Eligibility Criteria to specify method of glomerular filtration rate estimation for adult and adolescent subjects and to specify that topical corticosteroids (TCS) or topical calcineurin inhibitors (TCIs) are not contraindicated. ○ Updated contraception requirements to clarify age range of postmenopausal subjects and definition of childbearing potential to include female adolescents. ○ Updated to allow prohibited medications and therapy after discontinuation of study drug and to clarify cannabis prohibition duration. ○ Clarified required concomitant medication duration. ○ Clarified the daily use of TCS and/or TCI during the study with step-down regimen, the restriction of wet wraps, and use after premature study drug discontinuation. ○ Clarified that intentional/prospective deviations from withdrawal criteria are not permitted. ○ Incorporated biomarker procedure for subjects after withdrawal from the study. ○ Added clarification of treatment after end of study. ○ Updated details on how the study drug was to be taken, packaged and labelled, stored and disposed of, dose randomization, selection and timing of study drug, treatment compliance, and blinding. ○ Added proper detail of other study procedures originally found in the Operations Manual. ○ Updated pregnancy language, methods and timing of safety assessment, recording data and analyses of safety findings, and reporting of AEs and intercurrent illnesses.

(continued) ○ Added clarifications for management of toxicity, serious infections, serious gastrointestinal (GI) events, cardiovascular and embolic/thrombotic events, malignancy, electrocardiogram (ECG) abnormality, and select laboratory abnormalities. ○ Updated detail regarding the Data Monitoring Committee (DMC). ○ Provided additional detail regarding safety data collection and Suspected Unexpected Serious Adverse Reactions (SUSAR) reporting. ○ Clarified timing of population pharmacokinetic (PK) reporting. ○ Provided additional detail regarding subject consent. ○ Updated Activity Schedule to include review of pregnancy avoidance recommendations, additional height measures for adolescents, additional procedures at the 30-Day Follow-Up Visit, additional 12-lead ECGs, chest x-ray clarification, and urine drug screen.

○ Updated the benefits and risks to subjects to include safety language specifying that events of deep vein thrombosis and pulmonary embolism have been report in patients receiving Janus kinase (JAK) inhibitors including upadacitinib, and added text indicating that updating is not genotoxic but is teratogenic based on animal studies and there is no risk associated with administration in male partners of females of childbearing potential. ○ Updated toxicity management instructions to include management of herpes zoster and muscle-related events, added recommendation for periodic skin examination for patients at increased risk for skin cancer. ○ Instructions for the management of cardiovascular and embolic/thrombotic events were revised to make them specific to thrombosis events and included instructions that subjects must be discontinued if deep vein thrombosis, pulmonary embolus or non-cardiac, non-neurologic arterial thrombosis is confirmed. ○ Updated discontinuation criteria to include confirmed diagnosis of deep vein thrombosis, pulmonary embolus or non-cardiac, non-neurologic arterial thrombosis. ○ Added "Active" to tuberculosis (TB) and "adjudicated" to GI perforations in the list of reported AESIs.

○ Stated that study drug shipments could be made from the study site to the subject and that there were no time limits for study drug interruption if no permanent study drug discontinuation criteria had been met. ○ Updated to include details on how to perform specific activities/procedures that may be impacted by changes in global/local regulations due to the pandemic, provide guidance on delayed assessments due to the pandemic, and state which assessments may not be performed remotely. ○ Provided instructions for completing supplemental study case report forms in the case of COVID-19-related missed/virtual visit, study drug discontinuations, or AEs; added instruction to interrupt study drug in subjects with confirmed diagnosis of COVID-19. ○ Changed the last date of the open label (OL) long-term extension from Week 136 to Week 160. ○ Updated the study drug discontinuation criteria for Eczema Area and Severity Index (EASI) worsening of 25% or more to include the following: "For example, permanent study drug discontinuation would apply at Week 8 if EASI score worsening criteria are met at Week 4 and Week 8 without rescue therapy given at Week 4. Permanent study drug discontinuation would apply at Week 12 if EASI score worsening criteria are met at Week 8 and Week 12 with rescue therapy given at Week 4. This rule applies similarly to later timepoints." ○ In the safety section, added the supplemental electronic case report form for eczema herpeticum to the table of events that required a supplemental report, removed management of muscle-related events from toxicity management events, and updated guidelines for abnormal laboratory values for alanine aminotransferase (ALT) and aspartate transaminase (AST) in the toxicity management guidelines table.

(continued) ○ In the schedule of events, clarified that chest x-ray will be repeated annually (Weeks 100 and 148) starting at Week 52 if newly positive TB risk factor or results are obtained, added 12-lead ECG at Week 148 to accommodate extension to 160 weeks, clarified that blood samples for PK assay should not be taken at the Premature Discontinuation (PD) Visit if the PD Visit occurs after Week 16, and corrected the assessment time points for body surface area from every visit to only Screening, baseline, and Unscheduled Visits.