diff --git a/src/servers/plugins/update.ts b/src/servers/plugins/update.ts
index 239951ed..9d6c227a 100644
--- a/src/servers/plugins/update.ts
+++ b/src/servers/plugins/update.ts
@@ -73,7 +73,20 @@ export async function pullPlugin(appName: string, onLog?: OnLog): Promise<PullRe
   const branch = (await git(dir, ['rev-parse', '--abbrev-ref', 'HEAD'])).out;
   onLog?.(`[${appName}] pulling ${branch}`);
 
-  const pulled = await git(dir, ['pull', '--ff-only', 'origin', branch]);
+  // FETCH `HEAD`, THEN FAST-FORWARD. Not `pull origin <local branch name>`.
+  //
+  // The local branch and the remote's default are two different things, and they stopped agreeing the
+  // day the plugin repositories were standardised: a checkout made before that is on `main`, the remote
+  // has only `master`, and `git pull origin main` fails with "couldn't find remote ref main" — an Update
+  // button that can never work again on exactly the installs that most need it.
+  //
+  // `HEAD` resolves to whatever the remote's default is, so the local name stops mattering. The
+  // fast-forward then applies it to whichever branch this checkout happens to be on.
+  const fetched = await git(dir, ['fetch', 'origin', 'HEAD']);
+  if (fetched.code !== 0) {
+    return { ok: false, updated: false, before, after: before, error: fetched.err || 'git fetch failed' };
+  }
+  const pulled = await git(dir, ['merge', '--ff-only', 'FETCH_HEAD']);
   if (pulled.code !== 0) {
     return { ok: false, updated: false, before, after: before, error: pulled.err || pulled.out || 'git pull failed' };
   }