diff --git a/hive-c0re/src/lifecycle.rs b/hive-c0re/src/lifecycle.rs
index 5958081..fff549c 100644
--- a/hive-c0re/src/lifecycle.rs
+++ b/hive-c0re/src/lifecycle.rs
@@ -598,9 +598,25 @@ pub async fn git_tag(dir: &Path, name: &str, target: &str) -> Result<()> {
 /// have to escape anything.
 pub async fn git_tag_annotated(dir: &Path, name: &str, target: &str, body: &str) -> Result<()> {
     use tokio::io::AsyncWriteExt;
+    // Annotated tags are git objects, so they need a tagger identity
+    // (same constraint as a commit). Pass the hive-c0re identity
+    // inline rather than relying on a global git config — applied
+    // repos are hive-c0re-owned and the host's user might not have
+    // user.email set.
     let mut child = git_command()
         .current_dir(dir)
-        .args(["tag", "-a", name, target, "-F", "-"])
+        .args([
+            "-c",
+            &format!("user.name={GIT_NAME}"),
+            "-c",
+            &format!("user.email={GIT_EMAIL}"),
+            "tag",
+            "-a",
+            name,
+            target,
+            "-F",
+            "-",
+        ])
         .stdin(std::process::Stdio::piped())
         .stdout(std::process::Stdio::piped())
         .stderr(std::process::Stdio::piped())