diff --git a/lefthook.yml b/lefthook.yml
index 4dc05016ef..fc7e2f9ba9 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -75,6 +75,11 @@ commit-msg:
     signoff:
       run: 'git interpret-trailers --if-exists doNothing --trailer "Signed-off-by: $(git var GIT_COMMITTER_IDENT | sed ''s/ [0-9]* [+-][0-9]*$//'')" --in-place {1}'
 
+# Lanes below that run test suites or builds go through
+# scripts/without-git-env.sh, which strips git's repository-local variables
+# (per `git rev-parse --local-env-vars`) while preserving transport/credential
+# settings. The branch-skew and push-head-scope guards run no test fixtures
+# and need the caller's transport env, so they run unwrapped.
 pre-push:
   parallel: true
   commands:
@@ -90,36 +95,36 @@ pre-push:
     file-size-check:
       # The ratchet computes its own merge-base diff, so path filtering here
       # would only duplicate policy and create another place for coverage drift.
-      run: just file-size-check
+      run: ./scripts/without-git-env.sh just file-size-check
     rust-tests:
       files: git diff --name-only origin/main...HEAD
       glob: ["crates/**", "migrations/**", "schema/**", "Cargo.toml", "Cargo.lock", "rust-toolchain.toml", "deny.toml", "scripts/run-tests.sh", "Justfile"]
-      run: just test-unit
+      run: ./scripts/without-git-env.sh just test-unit
     desktop-check:
       files: git diff --name-only origin/main...HEAD
       glob: ["desktop/**", "pnpm-lock.yaml"]
       exclude: ["desktop/src-tauri/**"]
-      run: just desktop-check
+      run: ./scripts/without-git-env.sh just desktop-check
     desktop-typecheck:
       files: git diff --name-only origin/main...HEAD
       glob: ["desktop/**", "pnpm-lock.yaml"]
       exclude: ["desktop/src-tauri/**"]
-      run: just desktop-typecheck
+      run: ./scripts/without-git-env.sh just desktop-typecheck
     desktop-test:
       files: git diff --name-only origin/main...HEAD
       glob: ["desktop/**", "pnpm-lock.yaml"]
       exclude: ["desktop/src-tauri/**"]
-      run: just desktop-test
+      run: ./scripts/without-git-env.sh just desktop-test
     desktop-tauri-checks:
       # Keep local lint parity with Desktop Core CI for every path that can
       # affect the Tauri crate or its path dependencies. Run clippy and tests
       # serially so parallel pre-push hooks do not contend for Cargo's lock.
       files: git diff --name-only origin/main...HEAD
       glob: ["desktop/src-tauri/**", "crates/**", "migrations/**", "schema/**", "Cargo.toml", "Cargo.lock", "rust-toolchain.toml", "deny.toml", "scripts/run-tests.sh", "Justfile"]
-      run: just desktop-tauri-clippy && just desktop-tauri-test
+      run: ./scripts/without-git-env.sh sh -c 'just desktop-tauri-clippy && just desktop-tauri-test'
     mobile-checks:
       # Run analysis and tests serially so parallel pre-push hooks do not
       # contend for shared Flutter state (.dart_tool, shader bundle).
       files: git diff --name-only origin/main...HEAD
       glob: ["mobile/**"]
-      run: just mobile-check && just mobile-test
+      run: ./scripts/without-git-env.sh sh -c 'just mobile-check && just mobile-test'
diff --git a/scripts/without-git-env.sh b/scripts/without-git-env.sh
new file mode 100755
index 0000000000..236b948d8c
--- /dev/null
+++ b/scripts/without-git-env.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Git exports repository-local variables (GIT_DIR, GIT_INDEX_FILE, ...) to
+# hooks. Pre-push lanes run test suites whose fixtures spawn git in temp dirs;
+# with those variables inherited, fixtures operate on this checkout instead.
+# Transport, credential, and TLS settings (GIT_SSH_COMMAND, GIT_ASKPASS, ...)
+# are left intact.
+set -euo pipefail
+# shellcheck disable=SC2046
+unset $(git rev-parse --local-env-vars)
+exec "$@"