diff --git a/tools/ci/pre-push.sh b/tools/ci/pre-push.sh
index f596c9e51..c6364234d 100755
--- a/tools/ci/pre-push.sh
+++ b/tools/ci/pre-push.sh
@@ -20,6 +20,10 @@
 # and identity checks then read the committed pages; CI builds in place and checks the rebuilt pages, the one difference.
 set -uo pipefail
 cd "$(git rev-parse --show-toplevel)" || exit 1
+# git hands a hook its own repository through the environment (GIT_DIR, GIT_INDEX_FILE, GIT_PREFIX, ...). Left in place,
+# every nested git inside the self-tests (remote-run.sh builds a mirror and pushes into it) would act on THIS repository
+# and fire this hook again inside the fixture: the first master push through the gate died that way (6 October 2026).
+unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_PREFIX GIT_COMMON_DIR GIT_OBJECT_DIRECTORY GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_QUARANTINE_PATH GIT_PUSH_OPTION_COUNT
 MODE="${1:-local}"; MODE="${MODE#--}"
 RED=0; N=0; LOG="$(mktemp)"; trap 'rm -rf "$LOG" "${SITE_TMP:-}"' EXIT
 T0=$(date +%s)