diff --git a/app.py b/app.py
index 889e828..c215480 100644
--- a/app.py
+++ b/app.py
@@ -2,6 +2,7 @@ import hashlib
 import hmac
 import json
 import logging
+import subprocess
 import threading
 from flask import Flask, request, abort
 
@@ -91,6 +92,23 @@ def webhook():
     return {"status": "processing", "files": len(changed_files)}, 200
 
 
+def _self_update() -> None:
+    """Pull the latest code from origin before starting."""
+    try:
+        result = subprocess.run(
+            ["git", "pull", "--ff-only"],
+            capture_output=True,
+            text=True,
+        )
+        if result.returncode == 0:
+            logger.info("Self-update: %s", result.stdout.strip())
+        else:
+            logger.warning("Self-update failed: %s", result.stderr.strip())
+    except Exception as exc:
+        logger.warning("Self-update error: %s", exc)
+
+
 if __name__ == "__main__":
+    _self_update()
     logger.info("BLIGHT: CUE starting on port %d", config.WEBHOOK_PORT)
     app.run(host="0.0.0.0", port=config.WEBHOOK_PORT)