diff --git a/hive-c0re/src/lifecycle/git.rs b/hive-c0re/src/lifecycle/git.rs
index a54299d9..3461c956 100644
--- a/hive-c0re/src/lifecycle/git.rs
+++ b/hive-c0re/src/lifecycle/git.rs
@@ -167,3 +167,13 @@ pub async fn git_read_tree_reset(dir: &Path, target: &str) -> Result<()> {
 pub async fn git_update_ref(dir: &Path, refname: &str, target: &str) -> Result<()> {
     git(dir, &["update-ref", refname, target]).await
 }
+
+/// Delete a ref. The counterpart to [`git_update_ref`] for the bookkeeping
+/// refs a deploy parks in the applied repo (`refs/hyperhive/rollback/<id>`,
+/// which records the pre-merge `main` so the deploy tail can compensate a
+/// merge that landed but never finalized). `update-ref -d` is a no-op-free
+/// delete: it errors if the ref does not exist, so callers that treat absence
+/// as "nothing to undo" should check with [`git_rev_parse`] first.
+pub async fn git_delete_ref(dir: &Path, refname: &str) -> Result<()> {
+    git(dir, &["update-ref", "-d", refname]).await
+}
diff --git a/hive-c0re/src/lifecycle/mod.rs b/hive-c0re/src/lifecycle/mod.rs
index 1419f354..a1a2347f 100644
--- a/hive-c0re/src/lifecycle/mod.rs
+++ b/hive-c0re/src/lifecycle/mod.rs
@@ -7,8 +7,8 @@ mod setup;
 mod tests;
 
 pub use git::{
-    git, git_command, git_read_tree_reset, git_rev_parse, git_tag, git_tag_annotated,
-    git_update_ref,
+    git, git_command, git_delete_ref, git_read_tree_reset, git_rev_parse, git_tag,
+    git_tag_annotated, git_update_ref,
 };
 pub use host_config::write_dropins;
 pub use setup::{