diff --git a/MIGRATION-NOTES.md b/MIGRATION-NOTES.md
index 053a9f1..479f4b8 100644
--- a/MIGRATION-NOTES.md
+++ b/MIGRATION-NOTES.md
@@ -63,6 +63,8 @@ Live `~/.config` entries were symlinks into dotstate storage; content copied wit
 - **Inir / Vertical-Rogz_AppleStudio / CachyOS**: deferred entirely (except tmux.conf, claimed above). Future `.role` values.
 - **systemd user units**: unit files managed, enable-state not (except session-critical via `run_once` script).
 - **Compiled tools in `~/.local/bin`**: never vendored; installed via `packages.yaml`. Only hand-written scripts ship in `dot_local/bin/`.
+- **gitconfig `insteadOf` → `pushInsteadOf`**: live config rewrote *all* GitHub https URLs to ssh, which breaks every anonymous clone (lazy.nvim, tpm, fisher) on a machine without SSH keys — i.e. the bootstrap one-liner. `pushInsteadOf` keeps keyless https fetches working; pushes still use ssh; private https fetches use the `gh auth git-credential` helper. Found by the Arch container validation.
+- **`core.pager = git-split-diffs`**: npm-installed tool, not in `packages.yaml` (no node package management in pass 1). Interactive-only; git works without it (pager errors degrade to no pager). Same for the `tea` credential helper (prad.codes host only).
 
 ## Secrets audit results
 
diff --git a/dot_gitconfig.tmpl b/dot_gitconfig.tmpl
index 011cd5b..f258640 100644
--- a/dot_gitconfig.tmpl
+++ b/dot_gitconfig.tmpl
@@ -8,7 +8,7 @@
 	email = {{ .email }}
 	name = {{ .name }}
 [url "git@github.com:"]
-	insteadOf = https://github.com/
+	pushInsteadOf = https://github.com/
 [pager]
 	diff = diffnav
 [delta]