diff --git a/.gitea/workflows/mirror-to-github.yml b/.gitea/workflows/mirror-to-github.yml
index 603bd48f..d539080f 100644
--- a/.gitea/workflows/mirror-to-github.yml
+++ b/.gitea/workflows/mirror-to-github.yml
@@ -15,5 +15,8 @@ jobs:
           git clone --mirror https://gitea.resolutionflow.com/chihlasm/resolutionflow.git repo
           cd repo
           git remote add github https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${{ secrets.GH_MIRROR_REPO }}
-          git push github --all --force
-          git push github --tags --force
\ No newline at end of file
+          # --all + --tags scopes the push to refs/heads/* and refs/tags/*,
+          # avoiding refs/pull/* (which GitHub refuses with "deny updating a
+          # hidden ref"). --prune makes deletions on the Gitea side propagate.
+          git push github --all --prune --force
+          git push github --tags --prune --force
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index b6c612a4..5e6f7252 100644
--- a/.gitignore
+++ b/.gitignore
@@ -249,3 +249,6 @@ graphify-out/
 
 # remember skill runtime state (hook logs, PIDs)
 .remember/
+
+# MCP server config (per-machine, references local env vars for auth)
+.mcp.json