diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index 9c4adcd2..615e0794 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -1502,6 +1502,19 @@ fn write_nspawn_flags(
             format!("{flag}={}:{}", b.host_path, b.container_path)
         })
         .collect();
+    // Defense-in-depth for the knowledge bind-mount: overlay an empty tmpfs
+    // on /knowledge/.git so the repo metadata (including any credentials the
+    // host-side git worker embedded in .git/config) is invisible inside agent
+    // containers. Agents only need the working-tree documents; .git/ has no
+    // legitimate use in-container. The --tmpfs must come after the --bind-ro
+    // so nspawn processes it as an overlay on top of the already-mounted tree.
+    // `crate::knowledge::CONTAINER_MOUNT` is "/knowledge" (hive-c0re const).
+    if binds
+        .iter()
+        .any(|b| b.container_path.as_str() == "/knowledge")
+    {
+        flags.push("--tmpfs=/knowledge/.git".to_owned());
+    }
     // Credential forwarding: nspawn loads each host secret into the
     // container's credential store under `<name>`; inner units inherit it
     // via `LoadCredential=<name>`. Validated (name charset + bind-path