diff --git a/CLAUDE.md b/CLAUDE.md
index 4d557456..893a4dfb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -55,7 +55,7 @@ The workflow is tool-agnostic between Claude Code and opencode; `.claude/` stays
 
 ## Git workflow
 
-Branch protection on `main`: no direct pushes, no force pushes, no branch deletion. Branches: `feature/xxx`, `fix/xxx`, `chore/xxx`. **Squash merge only.** Never reuse a branch after its PR is squash-merged.
+Branch protection on `main`: no direct pushes, no force pushes, no branch deletion. Branches: `feature/xxx`, `fix/xxx`, `chore/xxx`. **Squash merge only.** Never reuse a branch after its PR is squash-merged. Never `--no-verify`/`--no-gpg-sign`. **Never perform an admin merge in any shape**: no `gh pr merge --admin`, no direct `PUT /repos/{owner}/{repo}/pulls/{number}/merge`, and no direct GraphQL `mergePullRequest` mutation. Naming the two raw API calls is deliberate; forbidding only the CLI flag leaves both API paths open. The admin override is Thomas's alone: if a merge genuinely needs one, STOP and ask him to merge it himself.
 
 Pre-commit hook: a git-level `pre-commit` (lefthook, `lefthook.yml`) runs `dotnet format Orbit.slnx --include <staged .cs>` on staged `.cs` files and re-stages the fixes. This repo has no Node, so there is no auto-install — bootstrap once per machine with `winget install evilmartians.lefthook` (fallbacks: `scoop install lefthook`, or a GitHub-release binary + `lefthook self-update`), then run `lefthook install` inside the clone to write `.git/hooks/pre-commit`.