diff --git a/tests/test_app.py b/tests/test_app.py
index ba473b0..1b0f3bf 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -42,7 +42,7 @@ def test_health_exposes_current_version():
     with TestClient(app.app) as client:
         response = client.get("/health")
     assert response.status_code == 200
-    assert response.json()["version"] == app.VERSION == "2.3.3"
+    assert response.json()["version"] == app.VERSION == "2.3.4"
 
 
 def test_sysctl_audit_reads_fixed_keys_from_inventory_host(monkeypatch):
@@ -108,6 +108,44 @@ def test_inventory_upsert_uses_base64_script(monkeypatch):
     assert "\\nname =" not in calls[0][1]
 
 
+def test_ansible_run_supports_safe_tune_action_and_syncs_git(monkeypatch):
+    calls = []
+
+    def fake_ssh(host, command, timeout=600):
+        calls.append((host, command, timeout))
+        return 0, "changed=1 failed=0", ""
+
+    monkeypatch.setattr(app, "_ssh", fake_ssh)
+    with TestClient(app.app) as client:
+        response = client.post(
+            "/ansible/run",
+            headers={"Authorization": "Bearer test-token"},
+            json={"hostname": "emby-sascha", "action": "tune"},
+        )
+    assert response.status_code == 200
+    assert response.json()["action"] == "tune"
+    assert "git pull --ff-only origin master" in calls[0][1]
+    assert "bash pfannkuchen.sh tune emby-sascha" in calls[0][1]
+    assert len(calls) == 1
+
+
+def test_ansible_run_rejects_unknown_action_and_shell_metacharacters(monkeypatch):
+    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not SSH")))
+    with TestClient(app.app) as client:
+        bad_action = client.post(
+            "/ansible/run",
+            headers={"Authorization": "Bearer test-token"},
+            json={"hostname": "emby-sascha", "action": "shell"},
+        )
+        bad_host = client.post(
+            "/ansible/run",
+            headers={"Authorization": "Bearer test-token"},
+            json={"hostname": "emby-sascha;id", "action": "tune"},
+        )
+    assert bad_action.status_code == 400
+    assert bad_host.status_code == 400
+
+
 def test_docker_inspect_returns_sanitized_summary(monkeypatch):
     raw = [{
         "Name": "/fileflows",