diff --git a/nix/host-modules/hive-c0re/default.nix b/nix/host-modules/hive-c0re/default.nix
index 056cdb92..557b497b 100644
--- a/nix/host-modules/hive-c0re/default.nix
+++ b/nix/host-modules/hive-c0re/default.nix
@@ -48,10 +48,18 @@ let
   # render). The `[credential]` stanza points git at the `hive-forge` helper
   # below, scoped to the forge host, for any `git+http` fetch from it as the
   # forge `core` user. hive-c0re's own forge reads use `forge::reader_token()` instead.
+  #
+  # git runs every matching `credential.helper`, system config first, so a
+  # host helper (e.g. `oauth`, which waits on a browser) would run ahead of
+  # ours. An empty `helper =` resets the list; it comes first at both the
+  # global and the forge level so no /etc/gitconfig helper survives.
   safeDirGitconfig = pkgs.writeText "hyperhive-safe-gitconfig" ''
     [safe]
     directory = *
+    [credential]
+    helper =
     [credential "http://${config.services.hyperhive.swarm.forge.domain}"]
+    helper =
     helper = hive-forge
     username = core
     [http]