diff --git a/doc/cli.markdown b/doc/cli.markdown
index 9f61b9b3..c01f6ada 100644
--- a/doc/cli.markdown
+++ b/doc/cli.markdown
@@ -2188,6 +2188,11 @@ purposes" (as the cloud builder needs previous images to compute delta
 updates), but the logs will not display the "Using cache" lines for each
 build step of a Dockerfile.
 
+#### --pull
+
+When pushing to a local device, force the base images to be pulled again.
+Currently this option is ignored when pushing to the balenaCloud builders.
+
 #### --noparent-check
 
 Disable project validation check of 'docker-compose.yml' file in parent folder
diff --git a/lib/actions-oclif/push.ts b/lib/actions-oclif/push.ts
index 50e47051..e4fb13ff 100644
--- a/lib/actions-oclif/push.ts
+++ b/lib/actions-oclif/push.ts
@@ -33,6 +33,7 @@ interface FlagsDef {
 	emulated: boolean;
 	dockerfile?: string; // DeviceDeployOptions.dockerfilePath (alternative Dockerfile)
 	nocache?: boolean;
+	pull?: boolean;
 	'noparent-check'?: boolean;
 	'registry-secrets'?: string;
 	gitignore?: boolean;
@@ -138,6 +139,11 @@ export default class PushCmd extends Command {
 				build step of a Dockerfile.`,
 			char: 'c',
 		}),
+		pull: flags.boolean({
+			description: stripIndent`
+				When pushing to a local device, force the base images to be pulled again.
+				Currently this option is ignored when pushing to the balenaCloud builders.`,
+		}),
 		'noparent-check': flags.boolean({
 			description: stripIndent`
 				Disable project validation check of 'docker-compose.yml' file in parent folder`,
@@ -310,6 +316,7 @@ export default class PushCmd extends Command {
 						registrySecrets,
 						multiDockerignore: options['multi-dockerignore'] || false,
 						nocache: options.nocache || false,
+						pull: options.pull || false,
 						nogitignore,
 						noParentCheck: options['noparent-check'] || false,
 						nolive: options.nolive || false,
diff --git a/lib/utils/device/deploy.ts b/lib/utils/device/deploy.ts
index 222ee5ea..a4494176 100644
--- a/lib/utils/device/deploy.ts
+++ b/lib/utils/device/deploy.ts
@@ -58,6 +58,7 @@ export interface DeviceDeployOptions {
 	nogitignore: boolean;
 	noParentCheck: boolean;
 	nolive: boolean;
+	pull: boolean;
 	detached: boolean;
 	services?: string[];
 	system: boolean;
@@ -526,6 +527,7 @@ async function assignDockerBuildOpts(
 				t: generateImageName(task.serviceName),
 				nocache: opts.nocache,
 				forcerm: true,
+				pull: opts.pull,
 			};
 			if (task.external) {
 				task.dockerOpts.authconfig = await getAuthConfigObj(