diff --git a/.githooks/pre-push b/.githooks/pre-push
new file mode 100755
index 00000000..e5101045
--- /dev/null
+++ b/.githooks/pre-push
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Pre-push gate. Blocks the push if any quality check fails.
+#
+# Install: `make hooks` (points git core.hooksPath at .githooks/).
+# Bypass: never. If this runs slowly, fix the slow test; don't reach
+# for --no-verify (git-commit skill forbids it).
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+# `make tools` installs Go-installed binaries into $HOME/go/bin (or
+# $GOBIN if set). Users routinely forget to put that on PATH, so the
+# hook prepends it here to avoid spurious "command not found" failures
+# for govulncheck / goimports / golangci-lint.
+export PATH="${GOBIN:-$HOME/go/bin}:$PATH"
+
+echo "==> pre-push: make push-check"
+make push-check
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 513131cc..2b25c9fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,6 +29,7 @@ heading, and (b) bumping `project.yaml` `version:` in the same commit.
   [ADR 0002](docs/ADRs/0002-sidecar-language-go.md) — Sidecar language: Go.
   [ADR 0003](docs/ADRs/0003-pql-as-supporter-tool.md) — pql as supporter tool; wrap, don't duplicate; pql is a Clide subsystem when present.
   [ADR 0004](docs/ADRs/0004-ignore-file-strategy.md) — Ignore file strategy (`ignore_files:` in `.pql/config.yaml`, layered).
+- Pre-push quality gate: `.githooks/pre-push` runs `make push-check` (lint + test + test-race + test-integration + vuln + app-analyze + app-test) so bad pushes are caught locally before they hit Gitea. The app-side targets gracefully noop until Flutter is scaffolded. Install with `make hooks` (sets `git config core.hooksPath .githooks`); the hook prepends `$GOBIN`/`$HOME/go/bin` to PATH so govulncheck resolves without the user touching their shell profile.
 - Go sidecar/CLI skeleton under `sidecar/` (module `git.schweitz.net/jpmschweitzer/clide/sidecar`): `cmd/clide/main.go`, `internal/cli` with a stdlib-flag dispatch, `internal/diag` mirroring pql's exit-code + stderr-JSON contract, `internal/version` with ldflag-stamped build info, and placeholder packages for `daemon`, `pty`, `proc`, `git`, `ipc`, `pql` awaiting their tier. `clide --version` emits JSON build-info today.
 - Root `Makefile` drives both the Go sidecar and the Flutter app under one toolchain. Version is read from `project.yaml` via awk and stamped into the sidecar via `-ldflags -X`. Flutter targets gracefully noop before the app is scaffolded so the Makefile is usable from day one. Pinned Go tooling (govulncheck, goimports, golangci-lint) installs via `make tools`.
 - `ci/` entry scripts: `test.sh`, `lint.sh` (includes the supply-chain gate — no green lint without a green CVE scan), `security.sh`, `release.sh` (stub).