diff --git a/runner/harness/abra.py b/runner/harness/abra.py
index 8eb4d4b..c199c51 100644
--- a/runner/harness/abra.py
+++ b/runner/harness/abra.py
@@ -134,7 +134,10 @@ def normalize_recipe_tags(recipe: str) -> int:
         # upstream lightweight tag) pulls the corrected tags instead.
         bare = os.path.expanduser(f"~/.abra/recipes/.{recipe}-ccci-fixed.git")
         subprocess.run(["rm", "-rf", bare], check=False)
-        subprocess.run(["git", "clone", "--quiet", "--bare", path, bare], check=True)
+        # --mirror (not --bare): copies ALL refs incl. refs/heads/main, so abra's later git ops
+        # (`app secret insert`, deploy) that fetch from origin find every ref ("reference not found"
+        # if main is missing). The annotated tags ride along.
+        subprocess.run(["git", "clone", "--quiet", "--mirror", path, bare], check=True)
         subprocess.run(
             ["git", "-C", path, "remote", "set-url", "origin", f"file://{bare}"], check=True
         )