diff --git a/scripts/src/hwlab-node.ts b/scripts/src/hwlab-node.ts
index 6cb909dd..12e7a6b3 100644
--- a/scripts/src/hwlab-node.ts
+++ b/scripts/src/hwlab-node.ts
@@ -2267,9 +2267,13 @@ function nodeRuntimeGitMirrorRun(scoped: ReturnType<typeof parseNodeScopedDelega
   ].join("\n");
   const result = runNodeK3sScript(spec, script, scoped.timeoutSeconds);
   const partialSuccess = nodeRuntimeGitMirrorFlushPartialSuccess(scoped, mirror, result);
-  const fallback = scoped.action === "sync" && !scoped.dryRun && !isCommandSuccess(result) && nodeRuntimeGitMirrorSyncFallbackAllowed(result)
+  const syncFallback = scoped.action === "sync" && !scoped.dryRun && !isCommandSuccess(result) && nodeRuntimeGitMirrorSyncFallbackAllowed(result)
     ? nodeRuntimeGitMirrorSyncFallback(scoped.spec, mirror, scoped.timeoutSeconds)
     : null;
+  const flushFallback = scoped.action === "flush" && !scoped.dryRun && !isCommandSuccess(result) && nodeRuntimeGitMirrorSyncFallbackAllowed(result)
+    ? nodeRuntimeGitMirrorFlushFallback(scoped.spec, mirror, scoped.timeoutSeconds)
+    : null;
+  const fallback = syncFallback ?? flushFallback;
   const partialSuccessRecovery = partialSuccess !== null && !scoped.dryRun
     ? nodeRuntimeGitMirrorRun({ ...scoped, domain: "git-mirror", action: "sync", confirm: true, dryRun: false, wait: true })
     : null;
@@ -2305,7 +2309,7 @@ function nodeRuntimeGitMirrorRun(scoped: ReturnType<typeof parseNodeScopedDelega
       ? partialSuccessRecovered
         ? undefined
         : "node-runtime-git-mirror-flush-post-push-fetch-failed"
-      : actionSucceeded ? status?.ok === false ? "node-runtime-git-mirror-status-failed-after-action" : undefined : fallback === null ? `node-runtime-git-mirror-${scoped.action}-failed` : "node-runtime-git-mirror-sync-fallback-failed",
+      : actionSucceeded ? status?.ok === false ? "node-runtime-git-mirror-status-failed-after-action" : undefined : fallback === null ? `node-runtime-git-mirror-${scoped.action}-failed` : `node-runtime-git-mirror-${scoped.action}-fallback-failed`,
     next: partialSuccess !== null
       ? partialSuccessRecovered
         ? { status: `bun scripts/cli.ts hwlab nodes git-mirror status --node ${scoped.node} --lane ${scoped.lane}` }
@@ -2366,6 +2370,52 @@ function nodeRuntimeGitMirrorSyncFallback(spec: HwlabRuntimeLaneSpec, mirror: No
   };
 }
 
+function nodeRuntimeGitMirrorFlushFallback(spec: HwlabRuntimeLaneSpec, mirror: NodeRuntimeGitMirrorTargetSpec, timeoutSeconds: number): Record<string, unknown> {
+  const writeUrl = nodeRuntimeGitMirrorHostWriteUrl(spec, mirror);
+  if (writeUrl === null) {
+    return {
+      ok: false,
+      mode: "host-workspace-fallback",
+      degradedReason: "node-runtime-git-mirror-write-service-unresolved",
+      next: { status: `bun scripts/cli.ts hwlab nodes git-mirror status --node ${spec.nodeId} --lane ${spec.lane}` },
+    };
+  }
+  const script = [
+    "set -eu",
+    `repository=${shellQuote(mirror.sourceRepository)}`,
+    `gitops_branch=${shellQuote(mirror.gitopsBranch)}`,
+    `mirror_write=${shellQuote(writeUrl)}`,
+    "github_remote=\"ssh://git@ssh.github.com:443/${repository}.git\"",
+    "tmp_ns=\"refs/unidesk/git-mirror-flush/${gitops_branch}/$(date +%s)-$$\"",
+    "local_gitops_tmp=\"$tmp_ns/local-gitops\"",
+    "github_gitops_tmp=\"$tmp_ns/github-gitops\"",
+    "cleanup() { git update-ref -d \"$local_gitops_tmp\" >/dev/null 2>&1 || true; git update-ref -d \"$github_gitops_tmp\" >/dev/null 2>&1 || true; }",
+    "trap cleanup EXIT",
+    "export GIT_SSH_COMMAND='ssh -o HostKeyAlias=ssh.github.com -o StrictHostKeyChecking=accept-new -o ConnectTimeout=20 -o ServerAliveInterval=5 -o ServerAliveCountMax=1'",
+    "git fetch --no-tags \"$mirror_write\" \"+refs/heads/${gitops_branch}:${local_gitops_tmp}\"",
+    "local_gitops_sha=$(git rev-parse --verify \"${local_gitops_tmp}^{commit}\")",
+    "git push \"$github_remote\" \"$local_gitops_sha:refs/heads/${gitops_branch}\"",
+    "git fetch --no-tags \"$github_remote\" \"+refs/heads/${gitops_branch}:${github_gitops_tmp}\"",
+    "github_gitops_sha=$(git rev-parse --verify \"${github_gitops_tmp}^{commit}\")",
+    "if [ \"$github_gitops_sha\" != \"$local_gitops_sha\" ]; then",
+    "  printf 'github gitops mismatch after fallback flush: local=%s github=%s\\n' \"$local_gitops_sha\" \"$github_gitops_sha\" >&2",
+    "  exit 46",
+    "fi",
+    "git push \"$mirror_write\" \"$github_gitops_sha:refs/mirror-stage/heads/${gitops_branch}\"",
+    "printf '{\"ok\":true,\"mode\":\"host-workspace-fallback\",\"gitopsCommit\":\"%s\",\"mirrorWrite\":\"%s\"}\\n' \"$github_gitops_sha\" \"$mirror_write\"",
+  ].join("\n");
+  const result = runTransWorkspaceStdinScript(spec.nodeId, spec.workspace, script, Math.max(60, Math.min(timeoutSeconds, 300)));
+  return {
+    ok: isCommandSuccess(result),
+    mode: "host-workspace-fallback",
+    reason: "k3s git-mirror flush job could not reach GitHub SSH; fallback pushes GitOps from the target workspace through ssh.github.com:443 and refreshes mirror-stage cache",
+    mirrorWrite: writeUrl,
+    result: compactRuntimeCommand(result),
+    degradedReason: isCommandSuccess(result) ? undefined : "node-runtime-git-mirror-host-fallback-failed",
+    valuesPrinted: false,
+  };
+}
+
 function nodeRuntimeGitMirrorHostWriteUrl(spec: HwlabRuntimeLaneSpec, mirror: NodeRuntimeGitMirrorTargetSpec): string | null {
   const result = runNodeK3sArgs(spec, ["kubectl", "-n", mirror.namespace, "get", "service", mirror.serviceWriteName, "-o", "jsonpath={.spec.clusterIP}{\":\"}{.spec.ports[0].port}"], 60);
   const value = result.stdout.trim();