diff --git a/.claude/settings.json b/.claude/settings.json
index 8727119dd9..49edc61332 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -157,7 +157,6 @@
       "WebFetch(domain:download-center.epson.com)",
       "WebFetch(domain:download.ebz.epson.net)",
       "WebFetch(domain:download.ebz.epson.net)",
-      "WebFetch(domain:download.fedoraproject.org)",
       "WebFetch(domain:download.rockylinux.org)",
       "WebFetch(domain:dyn.manpages.debian.org)",
       "WebFetch(domain:element.io)",
@@ -187,10 +186,7 @@
       "WebFetch(domain:framatube.org)",
       "WebFetch(domain:frappe.io)",
       "WebFetch(domain:frappeframework.com)",
-      "WebFetch(domain:ftp-stud.hs-esslingen.de)",
       "WebFetch(domain:ftp.debian.org)",
-      "WebFetch(domain:ftp.uni-stuttgart.de)",
-      "WebFetch(domain:ftp2.osuosl.org)",
       "WebFetch(domain:fvonline-db.bplaced.net)",
       "WebFetch(domain:gcc.gnu.org)",
       "WebFetch(domain:geminicli.com)",
@@ -255,11 +251,8 @@
       "WebFetch(domain:memcached.org)",
       "WebFetch(domain:meta.discourse.org)",
       "WebFetch(domain:micro-editor.github.io)",
-      "WebFetch(domain:mirror.dogado.de)",
       "WebFetch(domain:mirror.manjaro.org)",
-      "WebFetch(domain:mirror.netzwerge.de)",
       "WebFetch(domain:mirror.stream.centos.org)",
-      "WebFetch(domain:mirrors.xtom.de)",
       "WebFetch(domain:mobilizon.org)",
       "WebFetch(domain:moodle.org)",
       "WebFetch(domain:moodledev.io)",
diff --git a/library/keycloak_kcadm_update.py b/library/keycloak_kcadm_update.py
index dfeea36196..3913e0ec17 100755
--- a/library/keycloak_kcadm_update.py
+++ b/library/keycloak_kcadm_update.py
@@ -471,7 +471,9 @@ def run_module():
         )
 
     if object_kind == "client":
-        converge_client_scope_lists(run_kcadm, module, object_id, desired, realm, kcadm_exec)
+        converge_client_scope_lists(
+            run_kcadm, module, object_id, desired, realm, kcadm_exec
+        )
 
     result["changed"] = True
     result["result"] = desired_obj
diff --git a/tests/unit/python/scripts/system/worktree/test_down.py b/tests/unit/python/scripts/system/worktree/test_down.py
index 7786657989..a3681b8ffd 100644
--- a/tests/unit/python/scripts/system/worktree/test_down.py
+++ b/tests/unit/python/scripts/system/worktree/test_down.py
@@ -29,6 +29,15 @@ GIT_IDENTITY = {
     "GIT_COMMITTER_NAME": "test",
     "GIT_COMMITTER_EMAIL": "test@example.invalid",
 }
+GIT_REPO_SCOPE = (
+    "GIT_DIR",
+    "GIT_WORK_TREE",
+    "GIT_INDEX_FILE",
+    "GIT_COMMON_DIR",
+    "GIT_PREFIX",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+)
 NEEDS_UNPRIVILEGED = "clearing the write bit does not restrain root"
 
 
@@ -40,7 +49,10 @@ class WorktreeDownFixture:
         self.repo = self.root / "repo"
         self.base = self.root / "worktrees"
         self.checkout = self.base / "feat"
-        self.env = {**os.environ, **GIT_IDENTITY}
+        # Exception: run from a pre-commit hook, git exports GIT_DIR and GIT_INDEX_FILE,
+        # which would aim every command below at the real repo instead of this throwaway.
+        inherited = {k: v for k, v in os.environ.items() if k not in GIT_REPO_SCOPE}
+        self.env = {**inherited, **GIT_IDENTITY}
 
         scripts = self.repo / "scripts" / "system" / "worktree"
         scripts.parent.mkdir(parents=True)
diff --git a/utils/keycloak_scopes.py b/utils/keycloak_scopes.py
index 23f5e6b5e6..4b97b3f4a4 100644
--- a/utils/keycloak_scopes.py
+++ b/utils/keycloak_scopes.py
@@ -26,7 +26,9 @@ def named_id_map(run_kcadm, module, cmd):
     }
 
 
-def converge_client_scope_lists(run_kcadm, module, object_id, desired, realm, kcadm_exec):
+def converge_client_scope_lists(
+    run_kcadm, module, object_id, desired, realm, kcadm_exec
+):
     """Converge a client's default/optional client-scope lists to ``desired``."""
     plans = []
     for field, kind in (