diff --git a/.claude/skills/syncing-upstream-healthchat/SKILL.md b/.claude/skills/syncing-upstream-healthchat/SKILL.md
index 023ccea340..f465eb24cd 100644
--- a/.claude/skills/syncing-upstream-healthchat/SKILL.md
+++ b/.claude/skills/syncing-upstream-healthchat/SKILL.md
@@ -173,8 +173,19 @@ git push --force-with-lease=release/healthchat:<old tip> origin <scratch>:releas
 git checkout release/healthchat && git reset --hard origin/release/healthchat   # every clone
 ```
 
-The branch is unprotected: the push lands immediately. Old `healthchat-v*` tags keep their
-commits alive and off the branch line. Rewind =
+`release/healthchat` is the default branch and the repository ruleset `healthchat-base`
+(id 20385846, rules `deletion` + `non_fast_forward`, no bypass actors) rejects the force-push with
+`GH013 … Cannot force-push to this branch`. Classic branch protection is empty, so
+`gh api repos/<repo>/branches/<branch>/protection` says "not protected" — check
+`gh api repos/<repo>/rules/branches/release%2Fhealthchat` instead. Decision (2026-10-20): disable the
+ruleset for the push and re-enable it right after, no permanent bypass:
+```bash
+gh api -X PUT repos/Novaloop-AG/element-x-android/rulesets/20385846 -f enforcement=disabled
+git push --force-with-lease=release/healthchat:<old tip> origin <stack>:release/healthchat
+gh api -X PUT repos/Novaloop-AG/element-x-android/rulesets/20385846 -f enforcement=active
+gh api repos/Novaloop-AG/element-x-android/rulesets/20385846 -q .enforcement   # must print active
+```
+Old `healthchat-v*` tags keep their commits alive and off the branch line. Rewind =
 `git push --force origin healthchat-v<last>^{commit}:release/healthchat`. A rewind does not
 remove a tag or Play build made on the new history — tag only after the device tests. Then set
 the version, update `HEALTHCHAT_CHANGES.md`, the releasing skill ("Known branch divergence")