diff --git a/apps/server/git/simple-git-branch-manager.ts b/apps/server/git/simple-git-branch-manager.ts
index b8147d0..5b46640 100644
--- a/apps/server/git/simple-git-branch-manager.ts
+++ b/apps/server/git/simple-git-branch-manager.ts
@@ -208,7 +208,18 @@ export class SimpleGitBranchManager implements BranchManager {
   async fastForwardBranch(repoPath: string, branch: string, remote = 'origin'): Promise<void> {
     const git = simpleGit(repoPath);
     const remoteBranch = `${remote}/${branch}`;
-    await git.raw(['merge', '--ff-only', remoteBranch, branch]);
+
+    // Verify it's a genuine fast-forward (branch is ancestor of remote)
+    try {
+      await git.raw(['merge-base', '--is-ancestor', branch, remoteBranch]);
+    } catch {
+      throw new Error(`Cannot fast-forward ${branch}: it has diverged from ${remoteBranch}`);
+    }
+
+    // Use update-ref instead of git merge so dirty working trees don't block it.
+    // The clone may have uncommitted agent work; we only need to advance the ref.
+    const targetCommit = (await git.raw(['rev-parse', remoteBranch])).trim();
+    await git.raw(['update-ref', `refs/heads/${branch}`, targetCommit]);
     log.info({ repoPath, branch, remoteBranch }, 'fast-forwarded branch');
   }