diff --git a/deploy/setup-infra-mirror.sh b/deploy/setup-infra-mirror.sh
index a304e7a..b94f41f 100755
--- a/deploy/setup-infra-mirror.sh
+++ b/deploy/setup-infra-mirror.sh
@@ -98,14 +98,15 @@ echo "Fetching from Forgejo..."
 git fetch forgejo --prune 2>&1 | sed 's/^/  /'
 
 # Initial push to GitHub (will populate the empty repo)
-echo "Pushing initial state to GitHub..."
-# Sync local refs from forgejo remote refs first (mirrors what sync-mirror.sh does)
-while read branch; do
-    [ "$branch" = "HEAD" ] && continue
-    git update-ref "refs/heads/$branch" "refs/remotes/forgejo/$branch" 2>/dev/null || true
-done < <(git for-each-ref --format="%(refname:lstrip=3)" refs/remotes/forgejo/)
+# main_only mode: push ONLY refs/heads/main + tags, mirroring what sync-mirror.sh
+# does for this repo on the recurring path. Agent review branches stay Forgejo-only.
+echo "Pushing initial main + tags to GitHub..."
+git update-ref refs/heads/main refs/remotes/forgejo/main 2>/dev/null || {
+    echo "ERROR: forgejo/main ref missing — fetch may have failed" >&2
+    exit 1
+}
 
-git push origin --all 2>&1 | sed 's/^/  /' || {
+git push origin "refs/heads/main:refs/heads/main" 2>&1 | sed 's/^/  /' || {
     echo "WARN: initial push failed — you may need to authorize the PAT for $GITHUB_REPO" >&2
 }
 git push origin --tags 2>&1 | sed 's/^/  /' || true