diff --git a/hive-c0re/src/lifecycle.rs b/hive-c0re/src/lifecycle.rs
index b3395db..5958081 100644
--- a/hive-c0re/src/lifecycle.rs
+++ b/hive-c0re/src/lifecycle.rs
@@ -428,7 +428,18 @@ pub async fn setup_applied(
         let proposed_str = proposed.display().to_string();
         git(
             applied_dir,
-            &["fetch", "--no-tags", &proposed_str, "main:refs/heads/main"],
+            // --update-head-ok lets us fetch into refs/heads/main while
+            // HEAD still points there. git's default safeguard refuses
+            // to avoid index/working-tree desync, but the working tree
+            // is empty (we just `init`'d) and we read-tree-reset right
+            // after, so the safeguard is moot here.
+            &[
+                "fetch",
+                "--no-tags",
+                "--update-head-ok",
+                &proposed_str,
+                "main:refs/heads/main",
+            ],
         )
         .await?;
         git_read_tree_reset(applied_dir, "refs/heads/main").await?;