diff --git a/build.sh b/build.sh
old mode 100755
new mode 100644
diff --git a/claude.sh b/claude.sh
index 89f355a..62dcaa6 100755
--- a/claude.sh
+++ b/claude.sh
@@ -84,6 +84,8 @@ build_volume_args() {
 # ─── Commands ─────────────────────────────────────────────────────────────────
 cmd_start() {
     check_deps; load_env; build_volume_args
+    info "Pulling latest images..."
+    dc pull
     info "Starting proxy sidecar..."
     dc up -d proxy
     info "Launching Claude Code..."
@@ -123,6 +125,8 @@ cmd_web() {
     check_deps; load_env
     [[ -n "${WEBUI_PASSWORD:-}" ]] \
         || { error "WEBUI_PASSWORD is not set. Add it to .env before starting the web interface."; exit 1; }
+    info "Pulling latest images..."
+    dc pull
     info "Starting proxy and web interface..."
     dc up -d webui
     info "Web interface is up → http://0.0.0.0:7681"
diff --git a/hooks/pre-commit b/hooks/pre-commit
old mode 100755
new mode 100644
index 113d4ad..9e6e3ae
--- a/hooks/pre-commit
+++ b/hooks/pre-commit
@@ -2,7 +2,7 @@
 # Ensure control scripts stay executable.
 set -euo pipefail
 
-SCRIPTS=(claude.sh build.sh)
+SCRIPTS=(claude.sh build.sh hooks/pre-commit)
 
 for f in "${SCRIPTS[@]}"; do
     if [[ -f "$f" && ! -x "$f" ]]; then