diff --git a/deploy/yaris_app_updater.py b/deploy/yaris_app_updater.py
index 3866f78..6db4302 100644
--- a/deploy/yaris_app_updater.py
+++ b/deploy/yaris_app_updater.py
@@ -20,6 +20,9 @@ SERVER_URL = os.environ.get("YARIS_SERVER_URL", "https://yaris.ceaf.dev").rstrip
 APP_DIR = os.environ.get("YARIS_APP_DIR", "/home/yaris/app/yaris-obd/static/app")
 APK_PATH = os.path.join(APP_DIR, "yaris-obd.apk")
 
+# Cloudflare blocks the default Python-urllib UA with 403 — identify ourselves.
+_HEADERS = {"User-Agent": "yaris-obd-updater/1.0"}
+
 
 def sha256_file(path):
     h = hashlib.sha256()
@@ -30,7 +33,8 @@ def sha256_file(path):
 
 
 def fetch_json(url, timeout=20):
-    with urllib.request.urlopen(url, timeout=timeout) as r:
+    req = urllib.request.Request(url, headers=_HEADERS)
+    with urllib.request.urlopen(req, timeout=timeout) as r:
         return json.load(r)
 
 
@@ -63,7 +67,8 @@ def main():
     os.makedirs(APP_DIR, exist_ok=True)
     tmp = APK_PATH + ".part"
     try:
-        with urllib.request.urlopen(f"{SERVER_URL}/app/yaris-obd.apk", timeout=600) as r, open(tmp, "wb") as f:
+        req = urllib.request.Request(f"{SERVER_URL}/app/yaris-obd.apk", headers=_HEADERS)
+        with urllib.request.urlopen(req, timeout=600) as r, open(tmp, "wb") as f:
             while True:
                 chunk = r.read(1024 * 1024)
                 if not chunk: