diff --git a/apps/intranet/intranet.yaml b/apps/intranet/intranet.yaml
index 597fe10..964ab5e 100644
--- a/apps/intranet/intranet.yaml
+++ b/apps/intranet/intranet.yaml
@@ -44,6 +44,10 @@ spec:
             - -c
             - |
               set -e
+              # Cluster egress is fronted by a step-ca TLS proxy whose cert
+              # doesn't match github.com. The Notes repo is public so there's
+              # no secret to protect — skip verify.
+              export GIT_SSL_NO_VERIFY=true
               if [ -d /srv/flowercore-notes/.git ]; then
                 cd /srv/flowercore-notes && git fetch --depth=1 origin && git reset --hard origin/codex/notes-pimanager-live-drift
               else