diff --git a/scripts/update.sh b/scripts/update.sh
index 17dea53..237be03 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -14,6 +14,17 @@
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
+# Must run before anything else touches a file this script itself reads
+# (docker-compose.yml, .env.example, this script's own remaining lines) —
+# a self-updating script isn't guaranteed atomic against its own file
+# changing mid-run, so pulling later can execute a mix of old and new
+# script/compose content in one pass. Bit us for real: old GID-resolution
+# code ran, then this pulled in new var names docker-compose.yml now
+# requires, and nothing re-ran the (now-current) resolution step for
+# them — see issue #5's thread.
+echo "==> git pull"
+git pull --ff-only
+
 [ -f .env ] || cp .env.example .env
 
 # Handles all three cases: the KEY=value line is missing entirely (.env
@@ -81,9 +92,6 @@ else
   echo "HOST_RENDER_GID: no 'render' group on this host, set it manually if still blank."
 fi
 
-echo "==> git pull"
-git pull --ff-only
-
 echo "==> validating compose config"
 docker compose config -q