diff --git a/config/platform-infra/gitea.yaml b/config/platform-infra/gitea.yaml
index 0f912ce9..b0112bdd 100644
--- a/config/platform-infra/gitea.yaml
+++ b/config/platform-infra/gitea.yaml
@@ -47,7 +47,7 @@ sourceAuthority:
         - mirror-sync
   githubProxy:
     enabled: true
-    url: http://127.0.0.1:10808
+    url: http://10.42.0.1:10808
     noProxy:
       - 127.0.0.1
       - localhost
diff --git a/scripts/src/platform-infra-gitea-github-sync-server.mjs b/scripts/src/platform-infra-gitea-github-sync-server.mjs
index 189ca3b7..a91de9d8 100644
--- a/scripts/src/platform-infra-gitea-github-sync-server.mjs
+++ b/scripts/src/platform-infra-gitea-github-sync-server.mjs
@@ -56,7 +56,7 @@ createServer(async (req, res) => {
     running.add(repo.key);
     try {
       const sync = syncRepository(repo);
-      log({ event: "github-to-gitea-sync", repo: repo.key, ok: sync.ok, sourceCommit: sync.sourceCommit, snapshotRef: sync.snapshotRef, elapsedMs: Date.now() - startedAt, valuesPrinted: false });
+      log({ event: "github-to-gitea-sync", repo: repo.key, ok: sync.ok, sourceCommit: sync.sourceCommit, snapshotRef: sync.snapshotRef, error: sync.error ? redact(sync.error) : null, elapsedMs: Date.now() - startedAt, valuesPrinted: false });
       writeJson(res, sync.ok ? 200 : 500, { ok: sync.ok, event, repository, ref, repo: repo.key, ...sync, valuesPrinted: false });
     } finally {
       running.delete(repo.key);
@@ -136,6 +136,13 @@ function log(payload) {
   console.log(JSON.stringify(payload));
 }
 
+function redact(value) {
+  return String(value || "")
+    .replace(/Authorization: Basic [A-Za-z0-9+/=]+/gu, "Authorization: Basic <redacted>")
+    .replace(/x-access-token:[^@\s]+/gu, "x-access-token:<redacted>")
+    .slice(-1600);
+}
+
 function requiredEnv(name) {
   const value = process.env[name];
   if (!value) throw new Error(`missing env ${name}`);
diff --git a/scripts/src/platform-infra-gitea-remote.sh b/scripts/src/platform-infra-gitea-remote.sh
index 117842f1..a743916e 100644
--- a/scripts/src/platform-infra-gitea-remote.sh
+++ b/scripts/src/platform-infra-gitea-remote.sh
@@ -813,28 +813,51 @@ NODE
   test_rc=$?
   run_mirror_status >"$tmp/status-after-test.json" 2>"$tmp/status-after-test.err"
   status_rc=$?
-  python3 - "$ping_rc" "$test_rc" "$status_rc" "$repo_key" "$tmp/webhook-ping.json" "$tmp/webhook-ping.err" "$tmp/webhook-test.out" "$tmp/webhook-test.err" "$tmp/status-after-test.json" "$tmp/status-after-test.err" <<'PY'
+  python3 - "$ping_rc" "$test_rc" "$status_rc" "$repo_key" "$tmp/repos.json" "$tmp/webhook-ping.json" "$tmp/webhook-ping.err" "$tmp/webhook-test.out" "$tmp/webhook-test.err" "$tmp/status-after-test.json" "$tmp/status-after-test.err" <<'PY'
 import json, sys
 ping_rc, test_rc, status_rc = int(sys.argv[1]), int(sys.argv[2]), int(sys.argv[3])
 repo_key = sys.argv[4]
+repos_path = sys.argv[5]
 def text(path, limit=2000):
     try:
         return open(path, encoding="utf-8", errors="replace").read()[-limit:]
     except FileNotFoundError:
         return ""
+def github_head(repo):
+    import os, urllib.error, urllib.request
+    repository = repo["upstream"]["repository"]
+    branch = repo["upstream"]["branch"].replace("/", "%2F")
+    token = os.environ["UNIDESK_GITEA_GITHUB_TOKEN"]
+    req = urllib.request.Request(f"https://api.github.com/repos/{repository}/git/ref/heads/{branch}", method="GET")
+    req.add_header("Authorization", "Bearer " + token)
+    req.add_header("Accept", "application/vnd.github+json")
+    req.add_header("X-GitHub-Api-Version", "2022-11-28")
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            payload = json.loads(resp.read().decode("utf-8", errors="replace") or "{}")
+            return payload.get("object", {}).get("sha")
+    except Exception:
+        return None
 try:
-    ping = json.loads(text(sys.argv[5], 100000))
+    ping = json.loads(text(sys.argv[6], 100000))
 except Exception:
-    ping = {"ok": False, "error": text(sys.argv[6])}
+    ping = {"ok": False, "error": text(sys.argv[7])}
 try:
-    status = json.loads(text(sys.argv[9], 100000))
+    status = json.loads(text(sys.argv[10], 100000))
 except Exception:
     status = {}
+try:
+    repo_specs = json.load(open(repos_path, encoding="utf-8"))
+except Exception:
+    repo_specs = []
+expected_heads = {repo.get("key"): github_head(repo) for repo in repo_specs}
 rows = []
 for repo in status.get("repositories", []):
     if repo.get("key") == repo_key:
-        rows.append({**repo, "pingOk": ping_rc == 0 and ping.get("ok") is True, "testOk": test_rc == 0, "error": None if ping_rc == 0 and test_rc == 0 and repo.get("sourceBundleReady") else (ping.get("error") or text(sys.argv[8]) or text(sys.argv[10]))[:500]})
-payload = {"ok": ping_rc == 0 and test_rc == 0 and status_rc == 0 and all(row.get("sourceBundleReady") for row in rows), "repositories": rows, "githubPing": ping, "test": {"exitCode": test_rc, "stdoutTail": text(sys.argv[7]), "stderrTail": text(sys.argv[8])}, "valuesPrinted": False}
+        expected_head = expected_heads.get(repo_key)
+        branch_matches_github = bool(expected_head and repo.get("branchCommit") == expected_head)
+        rows.append({**repo, "expectedGitHubHead": expected_head, "branchMatchesGitHub": branch_matches_github, "pingOk": ping_rc == 0 and ping.get("ok") is True, "testOk": test_rc == 0, "error": None if ping_rc == 0 and test_rc == 0 and repo.get("sourceBundleReady") and branch_matches_github else (ping.get("error") or text(sys.argv[9]) or text(sys.argv[11]) or "gitea mirror branch does not match GitHub head")[:500]})
+payload = {"ok": ping_rc == 0 and test_rc == 0 and status_rc == 0 and all(row.get("sourceBundleReady") and row.get("branchMatchesGitHub") for row in rows), "repositories": rows, "githubPing": ping, "test": {"exitCode": test_rc, "stdoutTail": text(sys.argv[8]), "stderrTail": text(sys.argv[9])}, "valuesPrinted": False}
 print(json.dumps(payload, ensure_ascii=False, indent=2))
 sys.exit(0 if payload["ok"] else 1)
 PY