diff --git a/.env.example b/.env.example
index 56196ad..fe197b8 100644
--- a/.env.example
+++ b/.env.example
@@ -16,9 +16,11 @@ BACKEND_URL=http://localhost:8000
# so for LAN access this must be the host's LAN IP, not localhost (e.g.
# http://192.168.1.190:8000). Leave unset for localhost-only access.
NEXT_PUBLIC_API_URL=http://localhost:8000
-# "Git Repository" link on the landing page header, next to Sign in - only
-# rendered when this is set (e.g. https://git.ciagent.org/you/ci-agent).
-# Leave blank if you don't run a public git server for this deployment.
+# "Git Repository" link on the landing page header, next to Sign in.
+# Defaults to the canonical upstream repo (git.ciagent.org) when unset - the
+# button always shows, even on a clone that hasn't set this at all. Only set
+# this if you run your own self-hosted git server and want the button to
+# point at your fork instead of upstream.
NEXT_PUBLIC_GIT_REPO_URL=
# --- Reverse proxy (only relevant once deployed behind Cloudflare/Nginx) -----
diff --git a/apps/web/app/page.tsx b/apps/web/app/page.tsx
index 0949aee..64e31bd 100644
--- a/apps/web/app/page.tsx
+++ b/apps/web/app/page.tsx
@@ -5,6 +5,12 @@ import { Building2, LineChart, Mail, Radar, ShieldCheck, Sparkles } from "lucide
import { useSystemStatus } from "@/hooks/use-auth";
import { isLocalConvenience } from "@/lib/auth";
+// The canonical, authoritative repo - shown by default on every deployment
+// (including someone else's clone running on their own machine) unless
+// NEXT_PUBLIC_GIT_REPO_URL overrides it, e.g. because that clone runs its
+// own self-hosted git server instead of pointing back at this one.
+const CANONICAL_GIT_REPO_URL = "https://git.ciagent.org/saksham/CIAgent";
+
const steps = [
{
title: "Add a company",
@@ -48,16 +54,14 @@ export default function LandingPage() {