diff --git a/core/installer/soft/client.go b/core/installer/soft/client.go
index dd5bbfe..5163f23 100644
--- a/core/installer/soft/client.go
+++ b/core/installer/soft/client.go
@@ -16,6 +16,7 @@
 	"github.com/cenkalti/backoff/v4"
 	"github.com/go-git/go-billy/v5/memfs"
 	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/transport"
 	gitssh "github.com/go-git/go-git/v5/plumbing/transport/ssh"
 	"github.com/go-git/go-git/v5/storage/memory"
@@ -29,6 +30,7 @@
 	GetPublicKeys() ([]string, error)
 	RepoExists(name string) (bool, error)
 	GetRepo(name string) (RepoIO, error)
+	GetRepoBranch(name, branch string) (RepoIO, error)
 	GetAllRepos() ([]string, error)
 	GetRepoAddress(name string) string
 	AddRepository(name string) error
@@ -44,6 +46,8 @@
 	AddReadWriteCollaborator(repo, user string) error
 	AddReadOnlyCollaborator(repo, user string) error
 	AddWebhook(repo, url string, opts ...string) error
+	DisableAnonAccess() error
+	DisableKeyless() error
 }
 
 type realClient struct {
@@ -265,13 +269,30 @@
 	return err
 }
 
+func (ss *realClient) DisableAnonAccess() error {
+	log.Printf("Disabling anon access")
+	_, err := ss.RunCommand("settings", "anon-access", "no-access")
+	return err
+}
+
+func (ss *realClient) DisableKeyless() error {
+	log.Printf("Disabling anon access")
+	_, err := ss.RunCommand("settings", "allow-keyless", "false")
+	return err
+}
+
 type Repository struct {
 	*git.Repository
 	Addr RepositoryAddress
+	Ref  string
 }
 
 func (ss *realClient) GetRepo(name string) (RepoIO, error) {
-	r, err := CloneRepository(RepositoryAddress{ss.addr, name}, ss.signer)
+	return ss.GetRepoBranch(name, "master")
+}
+
+func (ss *realClient) GetRepoBranch(name, branch string) (RepoIO, error) {
+	r, err := CloneRepositoryBranch(RepositoryAddress{ss.addr, name}, branch, ss.signer)
 	if err != nil {
 		return nil, err
 	}
@@ -305,7 +326,12 @@
 }
 
 func CloneRepository(addr RepositoryAddress, signer ssh.Signer) (*Repository, error) {
-	fmt.Printf("Cloning repository: %s %s\n", addr.Addr, addr.Name)
+	return CloneRepositoryBranch(addr, "master", signer)
+}
+
+func CloneRepositoryBranch(addr RepositoryAddress, branch string, signer ssh.Signer) (*Repository, error) {
+	fmt.Printf("Cloning repository: %s %s %s\n", addr.Addr, addr.Name, branch)
+	ref := fmt.Sprintf("refs/heads/%s", branch)
 	c, err := git.Clone(memory.NewStorage(), memfs.New(), &git.CloneOptions{
 		URL: addr.FullAddress(),
 		Auth: &gitssh.PublicKeys{
@@ -320,7 +346,7 @@
 			},
 		},
 		RemoteName:      "origin",
-		ReferenceName:   "refs/heads/master",
+		ReferenceName:   plumbing.ReferenceName(ref),
 		SingleBranch:    true,
 		Depth:           1,
 		InsecureSkipTLS: true,
@@ -348,6 +374,7 @@
 	return &Repository{
 		Repository: c,
 		Addr:       addr,
+		Ref:        ref,
 	}, nil
 }
 
diff --git a/core/installer/soft/repoio.go b/core/installer/soft/repoio.go
index 191b291..458f688 100644
--- a/core/installer/soft/repoio.go
+++ b/core/installer/soft/repoio.go
@@ -209,6 +209,7 @@
 	if len(st) == 0 {
 		return "", nil // TODO(gio): maybe return ErrorNothingToCommit
 	}
+	fmt.Printf("@@@ %+v\n", st)
 	hash, err := wt.Commit(message, &git.CommitOptions{
 		Author: &object.Signature{
 			Name: "pcloud-installer",
@@ -223,11 +224,12 @@
 		Auth:       auth(r.signer),
 	}
 	if o.ToBranch != "" {
-		gopts.RefSpecs = []config.RefSpec{config.RefSpec(fmt.Sprintf("refs/heads/master:refs/heads/%s", o.ToBranch))}
+		gopts.RefSpecs = []config.RefSpec{config.RefSpec(fmt.Sprintf("%s:refs/heads/%s", r.repo.Ref, o.ToBranch))}
 	}
 	if o.Force {
 		gopts.Force = true
 	}
+	fmt.Println(3333)
 	return hash.String(), r.repo.Push(gopts)
 }
 
@@ -259,6 +261,7 @@
 	if o.ToBranch != "" {
 		popts = append(popts, WithToBranch(o.ToBranch))
 	}
+	fmt.Println(2222)
 	return r.CommitAndPush(msg, popts...)
 }