diff --git a/src/provision.py b/src/provision.py
index 3529d10..2039f41 100644
--- a/src/provision.py
+++ b/src/provision.py
@@ -226,16 +226,24 @@ def step_set_hostname(iot_host: str, hostname: str | None):
         "err": stderr[-500:],
     }
 
-def step_git_pull(iot_host: str, branch: str = "release"):
-    """Pull latest code from the repository on the device.
+def step_git_pull(iot_host: str, branch: str = "main"):
+    """Fetch latest tags from main branch and checkout the latest tag.
 
-    Executes git checkout and git pull in ~/bumble-auracast.
+    Executes git fetch, finds the latest tag, and checks it out in ~/bumble-auracast.
     """
     remote = (
         "set -e\n"
         "cd ~/bumble-auracast\n"
-        f"git checkout {shlex.quote(branch)}\n"
-        "git pull\n"
+        f"git fetch origin {shlex.quote(branch)} --tags\n"
+        "LATEST_TAG=$(git tag --sort=-v:refname | head -n 1)\n"
+        "if [ -z \"$LATEST_TAG\" ]; then\n"
+        "  echo 'No tags found, falling back to main branch' >&2\n"
+        f"  git checkout {shlex.quote(branch)}\n"
+        "  git pull origin " + shlex.quote(branch) + "\n"
+        "else\n"
+        "  echo \"Checking out latest tag: $LATEST_TAG\"\n"
+        "  git checkout \"$LATEST_TAG\"\n"
+        "fi\n"
     )
     ssh_cmd = ["ssh", "-p", str(SSH_PORT)]
     if SSH_KEY:
@@ -249,7 +257,7 @@ def step_git_pull(iot_host: str, branch: str = "release"):
     if proc.returncode != 0:
         print(f"❌ git pull: failed rc={proc.returncode}: {stderr}")
     else:
-        print("✅ git pull: completed")
+        print("✅ git pull: completed (latest tag checked out)")
 
     return {
         "rc": proc.returncode,
@@ -258,15 +266,13 @@ def step_git_pull(iot_host: str, branch: str = "release"):
     }
 
 def step_update_app(iot_host: str):
-    """Placeholder: start/enable required system services on the device.
+    """Install dependencies using poetry for the checked-out code.
 
-    Intention: SSH into the device and run systemctl enable --now <service> for required services.
-    Currently does nothing.
+    Assumes code is already at the correct version (via step_git_pull).
     """
     remote = (
         "set -e\n"
         "cd ~/bumble-auracast\n"
-        "git pull\n"
         "/home/caster/.local/bin/poetry config virtualenvs.in-project true\n"
         "/home/caster/.local/bin/poetry install\n"
     )