diff --git a/.github/workflows/pre-commit-advisory.yml b/.github/workflows/pre-commit-advisory.yml
index 645af8e..b4a0be0 100644
--- a/.github/workflows/pre-commit-advisory.yml
+++ b/.github/workflows/pre-commit-advisory.yml
@@ -79,6 +79,19 @@ jobs:
     # run, the default-branch scope is never populated, so every new
     # PR branch rebuilds hook envs from scratch on its first run.
     if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch))
+    # The push run seeds caches and gates nothing — its hook steps already
+    # end in `|| true` and the "reflect exit code" step below is
+    # pull_request-only, so it can never legitimately go red. It could still
+    # fail on an *infrastructure* step, and did: a transient
+    # `curl: (35) Recv failure: Connection reset by peer` while downloading
+    # the go-pre-commit release archive turned an otherwise-green k5s main
+    # into a red ❌ (k5s run 30964880559; a plain re-run went green with no
+    # change). A seed run failing costs PRs a cold cache, not correctness —
+    # that is not worth painting a service repo's default branch red.
+    #
+    # PR runs are unaffected: they keep failing loudly so engineers still see
+    # the ❌ that makes the advisory comment worth reading.
+    continue-on-error: ${{ github.event_name == 'push' }}
     steps:
       - uses: actions/checkout@v6
         with:
diff --git a/AGENTS.md b/AGENTS.md
index 237298a..2eb8b8d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -51,6 +51,8 @@ After tagging `vX.Y.Z+<svc>`, `tag-config.yml` mints a GitHub App token (`BOOTST
 
 It posts a sticky PR comment with hook output and fails the job (so engineers see a ❌), but is **not** in any repo's required-checks list. Scoped to PR diff (`--from-ref`/`--to-ref`) so engineers only see violations they introduced. If you ever wire a setup step (e.g. another language toolchain) into the advisory workflow, gate it behind an input that defaults to `false` — matches the existing `setup-dotnet` / `setup-node-pnpm` pattern.
 
+The **push-to-default-branch run is `continue-on-error`** — it only seeds caches (its hook steps end in `|| true`, and the exit-code-reflecting step is `pull_request`-only), so it gates nothing and must never redden a service repo's default branch. It previously could, via an infrastructure step rather than a hook: a transient `curl: (35) Recv failure` fetching the go-pre-commit release archive failed an otherwise-green k5s main. A failed seed costs PRs a cold cache, nothing more. Keep PR runs failing loudly — that ❌ is what makes the advisory comment worth reading.
+
 ## Editing playbook
 
 - **Changing the docker matrix shape** in `discover-services/action.yml`: its docker-release consumer now lives only on the frozen `@pre-stevedore` tag (never retarget it) — pinned callers' `ci.yml` files still read the matrix output, so treat the shape as frozen until the stevedore migration completes.