diff --git a/app.py b/app.py
index 70fd72a..83a2186 100644
--- a/app.py
+++ b/app.py
@@ -11,7 +11,7 @@ from fastapi.responses import JSONResponse, RedirectResponse
 from contextlib import asynccontextmanager
 
 log = logging.getLogger("butler")
-VERSION = "2.3.5"
+VERSION = "2.3.4"
 
 API_DIR = os.environ.get("API_KEY_DIR", "/data/api")
 VAULT_CACHE_DIR = os.environ.get("VAULT_CACHE_DIR", "/data/vault-cache")
@@ -1574,29 +1574,11 @@ async def ansible_run(request: Request, _=Depends(_verify)):
         return JSONResponse({"error": "action must be setup, tune or pvetune"}, status_code=400)
     if not re.fullmatch(r"[a-zA-Z0-9_.:-]+", hostname):
         return JSONResponse({"error": "invalid hostname/limit"}, status_code=400)
-    if action in {"tune", "pvetune"}:
-        approved_files = (
-            "roles/sysctl/defaults/main.yml",
-            "roles/sysctl/tasks/main.yml",
-            "group_vars/vps/sysctl.yml",
-            "sysctl-proxmox.yaml",
-            "roles/sysctl_proxmox/tasks/main.yml",
-        )
-        file_sync = " && ".join(
-            f"git show origin/master:{path} > {path}" for path in approved_files
-        )
-        command = (
-            "cd /app-config/ansible && "
-            "git fetch origin master && "
-            f"{file_sync} && "
-            f"bash pfannkuchen.sh {action} {hostname}"
-        )
-    else:
-        command = (
-            "cd /app-config/ansible && "
-            "git pull --ff-only origin master && "
-            f"bash pfannkuchen.sh {action} {hostname}"
-        )
+    command = (
+        "cd /app-config/ansible && "
+        "git pull --ff-only origin master && "
+        f"bash pfannkuchen.sh {action} {hostname}"
+    )
     rc, out, err = _ssh(AUTOMATION1, command, timeout=600)
     _audit("/ansible/run", "POST", 200 if rc == 0 else 502, f"{action} {hostname}")
     if action != "setup":
diff --git a/tests/test_app.py b/tests/test_app.py
index e9960d4..1b0f3bf 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -42,7 +42,7 @@ def test_health_exposes_current_version():
     with TestClient(app.app) as client:
         response = client.get("/health")
     assert response.status_code == 200
-    assert response.json()["version"] == app.VERSION == "2.3.5"
+    assert response.json()["version"] == app.VERSION == "2.3.4"
 
 
 def test_sysctl_audit_reads_fixed_keys_from_inventory_host(monkeypatch):
@@ -108,7 +108,7 @@ def test_inventory_upsert_uses_base64_script(monkeypatch):
     assert "\\nname =" not in calls[0][1]
 
 
-def test_ansible_run_supports_safe_tune_action_and_syncs_approved_files(monkeypatch):
+def test_ansible_run_supports_safe_tune_action_and_syncs_git(monkeypatch):
     calls = []
 
     def fake_ssh(host, command, timeout=600):
@@ -124,9 +124,7 @@ def test_ansible_run_supports_safe_tune_action_and_syncs_approved_files(monkeypa
         )
     assert response.status_code == 200
     assert response.json()["action"] == "tune"
-    assert "git fetch origin master" in calls[0][1]
-    assert "git show origin/master:roles/sysctl/tasks/main.yml" in calls[0][1]
-    assert "git pull --ff-only" not in calls[0][1]
+    assert "git pull --ff-only origin master" in calls[0][1]
     assert "bash pfannkuchen.sh tune emby-sascha" in calls[0][1]
     assert len(calls) == 1