diff --git a/src/servers/plugins/update.ts b/src/servers/plugins/update.ts
index b5712547..dac87d47 100644
--- a/src/servers/plugins/update.ts
+++ b/src/servers/plugins/update.ts
@@ -83,10 +83,31 @@ export async function pullPlugin(appName: string, onLog?: OnLog): Promise<PullRe
   //
   // `HEAD` resolves to whatever the remote's default is, so the local name stops mattering. The
   // fast-forward then applies it to whichever branch this checkout happens to be on.
-  const fetched = await git(dir, ['fetch', 'origin', 'HEAD']);
+  //
+  // `--tags` and `--update-head-ok` are not decoration. Tags are how `releaseState` decides whether there
+  // is anything to update to, so a fetch that skipped them would leave the Update button answering from
+  // refs older than the release it is offering.
+  const fetched = await git(dir, ['fetch', '--tags', 'origin', 'HEAD']);
   if (fetched.code !== 0) {
     return { ok: false, updated: false, before, after: before, error: fetched.err || 'git fetch failed' };
   }
+
+  /*
+    ALSO refresh the remote-tracking ref, which fetching `HEAD` does not.
+
+    `git fetch origin HEAD` writes FETCH_HEAD and nothing else — `refs/remotes/origin/<branch>` keeps
+    whatever it had. So after a successful pull the checkout is at the newest commit while `origin/master`
+    still points at an older one, and every `rev-list origin/master...HEAD` reports the checkout as AHEAD.
+
+    That is exactly what `plugins:check` reported on 2026-08-27: twenty-one installed plugins each with
+    "2 commit(s) NOT PUSHED", on a machine where nothing had been committed at all. A check that cries
+    wolf is one people stop reading, and the cause was here rather than there.
+
+    Best effort: the branch may not exist on the remote under this name, which is the same reason the
+    fetch above asks for `HEAD`. A failure leaves things exactly as they were before this line.
+  */
+  const branchRef = branch && branch !== 'HEAD' ? branch : null;
+  if (branchRef) await git(dir, ['fetch', 'origin', `+refs/heads/${branchRef}:refs/remotes/origin/${branchRef}`]);
   const pulled = await git(dir, ['merge', '--ff-only', 'FETCH_HEAD']);
   if (pulled.code !== 0) {
     return { ok: false, updated: false, before, after: before, error: pulled.err || pulled.out || 'git pull failed' };