diff --git a/src/provision.py b/src/provision.py
index 34dceca..b757005 100644
--- a/src/provision.py
+++ b/src/provision.py
@@ -162,6 +162,37 @@ def step_set_hostname(iot_host: str, hostname: str | None):
         "err": stderr[-500:],
     }
 
+def step_git_pull(iot_host: str, branch: str = "main"):
+    """Pull latest code from the repository on the device.
+
+    Executes git checkout and git pull in ~/bumble-auracast.
+    """
+    remote = (
+        "set -e\n"
+        "cd ~/bumble-auracast\n"
+        f"git checkout {shlex.quote(branch)}\n"
+        "git pull\n"
+    )
+    ssh_cmd = ["ssh", "-p", str(SSH_PORT)]
+    if SSH_KEY:
+        ssh_cmd += ["-i", SSH_KEY]
+    ssh_cmd += [f"{SSH_USER}@{iot_host}", remote]
+
+    proc = subprocess.run(ssh_cmd, check=False, capture_output=True, text=True)
+    stdout = (proc.stdout or "").strip()
+    stderr = (proc.stderr or "").strip()
+
+    if proc.returncode != 0:
+        print(f"❌ git pull: failed rc={proc.returncode}: {stderr}")
+    else:
+        print("✅ git pull: completed")
+
+    return {
+        "rc": proc.returncode,
+        "out": stdout[-500:],
+        "err": stderr[-500:],
+    }
+
 def step_update_app(iot_host: str):
     """Placeholder: start/enable required system services on the device.
 
@@ -202,8 +233,8 @@ def step_start_app(iot_host: str, app: str):
     Currently does nothing.
     """
     scripts = [
-        "update_and_run_pw_aes67.sh",
-        "update_and_run_server_and_frontend.sh",
+        "src/service/update_and_run_pw_aes67.sh",
+        "src/service/update_and_run_server_and_frontend.sh",
     ]
     remote = (
         "set -e\n"
@@ -299,12 +330,13 @@ def main():
     ap.add_argument(
         "--steps",
         nargs="+",
-        choices=["wg", "hostname", "update_app", "start_app", "finish", "all"],
+        choices=["pull", "wg", "hostname", "update_app", "start_app", "finish", "all"],
         default=["all"],
         help="Which steps to run. Default: all",
     )
     # Hostname will be taken from --name
     ap.add_argument("--app", choices=["ui", "script"], default="ui", help="Application mode to start")
+    ap.add_argument("--branch", default="main", help="Git branch to checkout and pull (default: main)")
     
     args = ap.parse_args()
 
@@ -319,14 +351,20 @@ def main():
     # Normalize steps
     steps = args.steps
     if "all" in steps:
-        steps = ["hostname", "wg", "update_app", "start_app", "finish"]
-    # Backward compatibility: map 'app' to 'start_app' if present
-    steps = ["start_app" if s == "app" else s for s in steps]
+        steps = ["pull", "hostname", "wg", "update_app", "start_app", "finish"]
 
     # Gather device facts once (may change after hostname step, but we at least log the initial state)
     facts = get_device_facts(args.iot_host)
 
     # Execute selected steps in order with logging
+    if "pull" in steps:
+        pull_info = step_git_pull(args.iot_host, args.branch)
+        write_provision_log({
+            "action": "pull",
+            "branch": args.branch,
+            **get_device_facts(args.iot_host),
+            **pull_info,
+        })
     if "hostname" in steps:
         host_info = step_set_hostname(args.iot_host, name)
         # refresh hostname after step (if a real implementation later changes it)
@@ -343,6 +381,7 @@ def main():
             **facts,
             **wg_info,
         })
+
     if "update_app" in steps:
         upd_info = step_update_app(args.iot_host)
         write_provision_log({