diff --git a/.claude/scripts/sync.sh b/.claude/scripts/sync.sh
index 8ad2db6..851360c 100755
--- a/.claude/scripts/sync.sh
+++ b/.claude/scripts/sync.sh
@@ -12,6 +12,21 @@ YELLOW='\033[1;33m'
 CYAN='\033[0;36m'
 NC='\033[0m'
 
+# --- Arg parsing -------------------------------------------------------------
+# Submodule advance (fetch + checkout main + merge --ff-only origin/main) is
+# expensive (full network fetch of every submodule) and is normally wasted work:
+# per CLAUDE.md the guru-rmm pinned commit lagging `main` is EXPECTED, not stale.
+# So it is opt-in. Default OFF. Enable with `--with-submodules` / `--submodules`
+# on the command line, or `SYNC_SUBMODULES=1` in the environment. Fresh-clone
+# init/populate (Phase 1a) always runs regardless — only the advance is gated.
+ADVANCE_SUBMODULES=0
+[ "${SYNC_SUBMODULES:-0}" = "1" ] && ADVANCE_SUBMODULES=1
+for arg in "$@"; do
+    case "$arg" in
+        --with-submodules|--submodules) ADVANCE_SUBMODULES=1 ;;
+    esac
+done
+
 # --- Guard: strip Windows path-as-filename cruft before staging -------------
 # Windows machines occasionally drop files literally named like "C:\path" or
 # ".claude\current-mode" into the repo. The illegal ':' / '\' chars get stored
@@ -217,15 +232,23 @@ if [ -f ".gitmodules" ] && git config --file .gitmodules --get-regexp '^submodul
         fi
     done < <(git config --file .gitmodules --get-regexp '^submodule\..*\.path$')
 
-    # Advance each initialized submodule to its remote branch tip.
-    git submodule foreach --quiet '
-        git fetch origin --quiet 2>/dev/null
-        git checkout main --quiet 2>/dev/null || git checkout master --quiet 2>/dev/null
-        git merge --ff-only origin/main --quiet 2>/dev/null || \
-            git merge --ff-only origin/master --quiet 2>/dev/null
-    ' 2>/dev/null
-    set -e
-    echo -e "${GREEN}[OK]${NC} Submodules init+advanced (${SUB_COUNT} configured)."
+    # Advance each initialized submodule to its remote branch tip. Opt-in only
+    # (see arg-parsing block near the top): a full network fetch + ff-merge of
+    # every submodule on every sync is normally wasted work and churns the
+    # pinned-commit pointer, which CLAUDE.md says SHOULD lag `main`.
+    if [ "$ADVANCE_SUBMODULES" = "1" ]; then
+        git submodule foreach --quiet '
+            git fetch origin --quiet 2>/dev/null
+            git checkout main --quiet 2>/dev/null || git checkout master --quiet 2>/dev/null
+            git merge --ff-only origin/main --quiet 2>/dev/null || \
+                git merge --ff-only origin/master --quiet 2>/dev/null
+        ' 2>/dev/null
+        set -e
+        echo -e "${GREEN}[OK]${NC} Submodules init+advanced (${SUB_COUNT} configured)."
+    else
+        set -e
+        echo -e "${YELLOW}[INFO]${NC} Submodule advance skipped (pinned commit lagging main is expected; pass --with-submodules to fetch+advance). ${SUB_COUNT} configured."
+    fi
 else
     echo -e "${GREEN}[OK]${NC} No submodules."
 fi