diff --git a/sw/update-ref.nix b/sw/update-ref.nix
index 7c2a81d..19f5009 100644
--- a/sw/update-ref.nix
+++ b/sw/update-ref.nix
@@ -109,14 +109,38 @@
             ;;
 
           -p|--push)
-            PUSH_SET=1; DO_PUSH=1
-            # optional next token remote or remote=URL (only if it doesn't look like another flag/subcommand)
-            if [ "$#" -ge 2 ] && printf "%s" "$2" | grep -qvE '^(user=|system=|--|-l$|-r$)$'; then
-              PUSH_SPEC="$2"; shift 2
+            PUSH_SET=1
+            DO_PUSH=1
+            PUSH_SPEC=""
+
+            # If there is a next token, only consume it if it is a remote spec
+            # and not another flag or the subcommand.
+            if [ "$#" -ge 2 ]; then
+              nxt="$2"
+
+              if printf "%s" "$nxt" | grep -qE '^(user=|system=)'; then
+                # next token is the subcommand; don't consume it
+                shift
+              elif printf "%s" "$nxt" | grep -qE '^-'; then
+                # next token is another flag; don't consume it
+                shift
+              elif printf "%s" "$nxt" | grep -qE '^[A-Za-z0-9._-]+$'; then
+                # remote name
+                PUSH_SPEC="$nxt"
+                shift 2
+              elif printf "%s" "$nxt" | grep -qE '^[A-Za-z0-9._-]+=.+$'; then
+                # remote=URL
+                PUSH_SPEC="$nxt"
+                shift 2
+              else
+                # unknown token; treat as not-a-push-spec and don't consume it
+                shift
+              fi
             else
               shift
             fi
             ;;
+
           -p=*|--push=*)
             PUSH_SET=1
             val="''${1#*=}"