diff --git a/zsh/.zshrc b/zsh/.zshrc
index 753eed3..663c5f5 100644
--- a/zsh/.zshrc
+++ b/zsh/.zshrc
@@ -25,13 +25,21 @@ if [[ -f ~/.zsh/.shared_config ]] ; then
     touch ~/.config/nvim/.shared_config
 fi
 
+# On shell start, bring ~/dotfiles up to date by fast-forwarding the CURRENT
+# branch to its upstream only. Never rebase or stash in the background: if the
+# branch diverged or local edits block it, warn and leave it for a manual pull.
+# Per-branch, so `server` on each device fast-forwards to origin/server.
 update_dotfiles() {
-    cd ~/dotfiles || return
-    if git fetch --dry-run 2>&1 | grep -q .; then
-        git pull > /dev/null 2>&1
-    fi
+    local repo="$HOME/dotfiles"
+    git -C "$repo" fetch --quiet 2>/dev/null || return
+    git -C "$repo" rev-parse --abbrev-ref '@{u}' >/dev/null 2>&1 || return    # no upstream
+    git -C "$repo" merge-base --is-ancestor '@{u}' HEAD 2>/dev/null && return # already current
+    git -C "$repo" merge --ff-only --quiet '@{u}' 2>/dev/null \
+        || print -u2 "⚠ dotfiles: $(git -C "$repo" symbolic-ref --short HEAD) can't fast-forward to @{u} — run: git -C ~/dotfiles pull"
 }
 
+update_dotfiles &!
+
 if [ "$shared_config" -eq 0 ]; then
     update_dotfiles 2>&1 &!
     export GIT_AUTHOR_NAME="Fabian Ising"
@@ -40,8 +48,6 @@ if [ "$shared_config" -eq 0 ]; then
     export GIT_COMMITTER_EMAIL=$GIT_AUTHOR_EMAIL
 fi
 
-
-
 # Load Antidote
 mkdir -p ${ZDOTDIR:-~}/.cache/zsh
 static_file=${ZDOTDIR:-~}/.cache/zsh/.zsh_plugins.zsh