diff --git a/flake.nix b/flake.nix
index 143667f..371185f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -168,11 +168,18 @@
                 ];
               };
 
-              # Auto-upgrade: pulls latest flake and runs nixos-rebuild switch
-              # To update manually: sudo nixos-rebuild switch --flake git+ssh://forgejo@git.atitlan.io/aiolabs/lamassu-next.git#<model>-installed
+              # Auto-upgrade: pulls latest flake and runs nixos-rebuild switch.
+              # NOTE: this branch (dev) pins the upgrade source to ?ref=dev so
+              # any ATM flashed from `dev` stays on `dev`. Without the explicit
+              # ref, nix would resolve to the repo's default branch (main),
+              # which would silently regress a dev-deployed Sintra back to the
+              # lamassu-next production code at 04:00. The `main` branch's
+              # flake.nix continues to omit ?ref= so production ATMs (batm3,
+              # douro) keep pulling main HEAD as before.
+              # To update manually: sudo nixos-rebuild switch --flake git+ssh://forgejo@git.atitlan.io/aiolabs/lamassu-next.git?ref=dev#<model>-installed
               system.autoUpgrade = {
                 enable = true;
-                flake = "git+ssh://forgejo@git.atitlan.io/aiolabs/lamassu-next.git#${machineModel}-installed";
+                flake = "git+ssh://forgejo@git.atitlan.io/aiolabs/lamassu-next.git?ref=dev#${machineModel}-installed";
                 flags = [ "--refresh" ];
                 dates = "04:00"; # daily at 4am
                 allowReboot = false;