diff --git a/deploy/webmail.sh b/deploy/webmail.sh
index fc74ad8..9fc94b0 100755
--- a/deploy/webmail.sh
+++ b/deploy/webmail.sh
@@ -2,6 +2,7 @@
 # Webmail operator control script. One command per thing you might need to do.
 #
 #   ./deploy/webmail.sh init            create data dirs + a filled-in .env.prod
+#   ./deploy/webmail.sh pull [tag]      fetch prebuilt images from your registry
 #   ./deploy/webmail.sh up [--meili]    start (builds images if missing)
 #   ./deploy/webmail.sh down            stop (data is untouched)
 #   ./deploy/webmail.sh status          what is running, and which version
@@ -370,6 +371,20 @@ then re-run this command."
     echo "    admin: http://<this-host>:${ADMIN_PORT:-8089}/ — restrict this port to your LAN"
 }
 
+# First install from a registry: `up` only builds what is missing locally, and
+# `update` refuses to run without an existing database to back up. This is the
+# gap between them — fetch the images, then `up` starts them instead of building.
+cmd_pull() {
+    require_env
+    local tag="${1:-${IMAGE_TAG:-local}}"
+    [ "${REGISTRY_PREFIX:-webmail}" = "webmail" ] && die \
+        "REGISTRY_PREFIX is still the local default — nothing to pull from.
+    Set REGISTRY_PREFIX and IMAGE_TAG in ${ENV_FILE}, or use: webmail.sh up --build"
+    detect_compose
+    IMAGE_TAG="$tag" compose pull || die "pull failed — is the registry reachable and logged in?"
+    grn "pulled ${REGISTRY_PREFIX}/{backend,web}:${tag}. Next: ./deploy/webmail.sh up"
+}
+
 cmd_down()    { require_env; compose --profile meili down; grn "stopped (data kept in ${DATA_ROOT})"; }
 cmd_restart() { require_env; compose restart "${@:-}"; }
 
@@ -559,6 +574,7 @@ SUBCOMMAND="$cmd"
 case "$cmd" in
     init)     cmd_init "$@" ;;
     doctor)   cmd_doctor "$@" ;;
+    pull)     cmd_pull "$@" ;;
     up)       cmd_up "$@" ;;
     down)     cmd_down "$@" ;;
     restart)  cmd_restart "$@" ;;
diff --git a/docs/nas-install.md b/docs/nas-install.md
index d5d6c28..79d66c2 100644
--- a/docs/nas-install.md
+++ b/docs/nas-install.md
@@ -290,15 +290,20 @@ docker login 192.168.1.185:8418
 From then on, on your PC:
 
 ```bash
-REGISTRY_PREFIX=192.168.1.185:8418/claude/webmail ./deploy/build-push.sh v1.0.0
+REGISTRY_PREFIX=192.168.1.185:8418/<you>/webmail ./deploy/build-push.sh v1.0.0
 ```
 
 and on the NAS, with `REGISTRY_PREFIX` and `IMAGE_TAG` set in `.env`:
 
 ```bash
-bash deploy/webmail.sh update v1.0.0
+bash deploy/webmail.sh pull v1.0.0      # first install
+bash deploy/webmail.sh update v1.0.0    # every time after
 ```
 
+`pull` exists because the other two don't cover a first install from a
+registry: `up` only builds what is missing locally, and `update` refuses to run
+without an existing database to back up.
+
 > If you would rather not loosen the daemon, `./deploy/build-push.sh v1.0.0
 > --save` writes a tar you copy over and `docker load` — no registry, no
 > insecure flag, but a manual copy each time.
@@ -404,8 +409,8 @@ the dump that `update` took in step 1.
 Building on the NAS is simple but slow and RAM-hungry. Two alternatives:
 
 ```bash
-# On your PC — push to your Gitea registry:
-REGISTRY_PREFIX=192.168.1.185:8418/claude/webmail ./deploy/build-push.sh v1.0.0
+# On your PC — push to your Gitea registry (the namespace is your Gitea user):
+REGISTRY_PREFIX=192.168.1.185:8418/<you>/webmail ./deploy/build-push.sh v1.0.0
 # then on the NAS, set REGISTRY_PREFIX + IMAGE_TAG in .env and:
 ./deploy/webmail.sh update v1.0.0