diff --git a/scripts/setup/officer-setup/lib/layout.sh b/scripts/setup/officer-setup/lib/layout.sh
index 8ed7b6ce..fade90c7 100644
--- a/scripts/setup/officer-setup/lib/layout.sh
+++ b/scripts/setup/officer-setup/lib/layout.sh
@@ -85,7 +85,9 @@ capabilities_sync() {
   local dir; dir="$(layout_items_dir)"
 
   if [[ -d "$dir/.git" ]]; then
-    (cd "$dir" && git pull --ff-only --quiet origin main 2>/dev/null) || return 1
+    # `HEAD` rather than a branch name — it resolves to the remote's default, so standardising the
+    # repositories on one name does not break this the way naming `main` did.
+    (cd "$dir" && git pull --ff-only --quiet origin HEAD 2>/dev/null) || return 1
     return 0
   fi
 
@@ -99,7 +101,7 @@ capabilities_sync() {
     (cd "$dir" \
       && git init --quiet \
       && git remote add origin "$CAPABILITIES_REPO" 2>/dev/null \
-      && git fetch --quiet origin main \
-      && git checkout --quiet -B main FETCH_HEAD) || return 1
+      && git fetch --quiet origin HEAD \
+      && git checkout --quiet -B master FETCH_HEAD) || return 1
   fi
 }
diff --git a/src/servers/plugins/update.ts b/src/servers/plugins/update.ts
index 3ac29602..239951ed 100644
--- a/src/servers/plugins/update.ts
+++ b/src/servers/plugins/update.ts
@@ -146,7 +146,10 @@ export async function syncCapabilities(onLog?: OnLog): Promise<CapabilitiesResul
           return { ok: false, action: 'failed', error: `capabilities has ${tracked.length} uncommitted change(s)` };
         }
       }
-      const pulled = await git(dir, ['pull', '--ff-only', 'origin', 'main']);
+      // `HEAD`, not a branch name: it resolves to whatever the remote's default is. Naming `main` here
+      // broke the day the repositories were standardised on `master`, and naming `master` would break
+      // the day anything moves back. Same reasoning as the marketplace icon URLs.
+      const pulled = await git(dir, ['pull', '--ff-only', 'origin', 'HEAD']);
       if (pulled.code !== 0) return { ok: false, action: 'failed', error: pulled.err || 'git pull failed' };
       onLog?.('[capabilities] pulled');
       return { ok: true, action: 'pulled' };
@@ -162,8 +165,9 @@ export async function syncCapabilities(onLog?: OnLog): Promise<CapabilitiesResul
     for (const argv of [
       ['init', '--quiet'],
       ['remote', 'add', 'origin', CAPABILITIES_REPO],
-      ['fetch', '--quiet', 'origin', 'main'],
-      ['checkout', '--quiet', '-B', 'main', 'FETCH_HEAD'],
+      ['fetch', '--quiet', 'origin', 'HEAD'],
+      // The LOCAL branch still needs a name; the remote's default is whatever FETCH_HEAD just pointed at.
+      ['checkout', '--quiet', '-B', 'master', 'FETCH_HEAD'],
     ]) {
       const r = await git(dir, argv);
       // `remote add` fails when one is already there, which is not a problem worth stopping for.