diff --git a/.github/workflows/entry-push-latest.yml b/.github/workflows/entry-push-latest.yml
index ed3f8bde73..a22ee0ca8b 100644
--- a/.github/workflows/entry-push-latest.yml
+++ b/.github/workflows/entry-push-latest.yml
@@ -19,28 +19,8 @@ permissions:
   contents: read
 
 jobs:
-  sync-main:
-    name: 🔄 Sync main
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: ⬇️ Checkout repository
-        uses: actions/checkout@v7.0.0
-        with:
-          fetch-depth: 0
-
-      - name: 🔄 Sync main from source repository
-        shell: bash
-        env:
-          CI_SYNC_MAIN_SOURCE_REPOSITORY_DEFAULT: infinito-nexus/core
-          CI_SYNC_MAIN_SOURCE_REPOSITORY: ${{ vars.CI_SYNC_MAIN_SOURCE_REPOSITORY }}
-          CI_SYNC_MAIN_SOURCE_REPOSITORY_IS_SET: ${{ contains(toJSON(vars), '"CI_SYNC_MAIN_SOURCE_REPOSITORY"') }}
-        run: ./scripts/github/sync/main_from_repository.sh
-
   run-policy:
     name: 🧭 Decide CI policy
-    needs: sync-main
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -58,9 +38,13 @@ jobs:
       - name: ⬇️ Fetch main
         if: github.event.created == true
         shell: bash
+        env:
+          CI_SYNC_MAIN_SOURCE_REPOSITORY_DEFAULT: infinito-nexus/core
+          CI_SYNC_MAIN_SOURCE_REPOSITORY: ${{ vars.CI_SYNC_MAIN_SOURCE_REPOSITORY }}
+          CI_SYNC_MAIN_SOURCE_REPOSITORY_IS_SET: ${{ contains(toJSON(vars), '"CI_SYNC_MAIN_SOURCE_REPOSITORY"') }}
         run: |
           set -euo pipefail
-          git fetch origin main:refs/remotes/origin/main --force
+          git fetch "$(./scripts/meta/resolve/baseline_remote.sh)" main:refs/remotes/origin/main --force
 
       - name: 🤔 Decide whether CI should run for this push
         id: decide
diff --git a/scripts/github/README.md b/scripts/github/README.md
index e69221675c..d3e2d3eb9b 100644
--- a/scripts/github/README.md
+++ b/scripts/github/README.md
@@ -10,7 +10,6 @@ This directory holds the shell helpers that GitHub Actions workflows under [`.gi
 | [cancel/](cancel/) | Cancellation of in-progress workflow runs on PR-close and branch-delete events. |
 | [cleanup/](cleanup/) | Scheduled repository maintenance that prunes stale GitHub resources. |
 | [resolve/](resolve/) | Derivation of structured workflow inputs and outputs from repository state. |
-| [sync/](sync/) | Ref synchronization before workflow jobs derive CI scope from git history. |
 | [update/](update/) | The scheduled `🔄 Update versions` pipeline (version bumps and PR open/refresh). |
 | [release/](release/) | Release-time gates that decide whether a tagged commit may be released. |
 
diff --git a/scripts/github/sync/README.md b/scripts/github/sync/README.md
deleted file mode 100644
index 27f8b3560e..0000000000
--- a/scripts/github/sync/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# GitHub Sync Helpers 🔄
-
-This directory contains shell helpers that synchronize repository refs before later workflow jobs derive CI scope from git history.
diff --git a/scripts/meta/resolve/README.md b/scripts/meta/resolve/README.md
index 8351128102..cddad79b52 100644
--- a/scripts/meta/resolve/README.md
+++ b/scripts/meta/resolve/README.md
@@ -8,6 +8,7 @@ This directory contains scripts that resolve metadata and derived values used by
 
 Examples in this folder and its subfolders:
 
+- `baseline_remote.sh` resolves the remote whose main CI diffs against
 - `repository/name.sh` resolves the concrete repository name once for callers
 - `repository/owner.sh` resolves the concrete repository owner once for callers
 - See [pr/README.md](pr/README.md) for the Pull Request-specific resolvers.
diff --git a/scripts/github/sync/main_from_repository.sh b/scripts/meta/resolve/baseline_remote.sh
similarity index 62%
rename from scripts/github/sync/main_from_repository.sh
rename to scripts/meta/resolve/baseline_remote.sh
index c19bbdb0cc..6d4b93911a 100755
--- a/scripts/github/sync/main_from_repository.sh
+++ b/scripts/meta/resolve/baseline_remote.sh
@@ -1,7 +1,20 @@
 #!/usr/bin/env bash
+#
+# Output: the git remote carrying the upstream main that CI diffs against —
+# either the literal `origin` or a fetch URL, usable as
+# `git fetch "$(baseline_remote.sh)" main:refs/remotes/origin/main`.
+#
+# Env:
+#   GITHUB_REPOSITORY                        - owner/repo of the running job; unset means a local clone
+#   CI_SYNC_MAIN_SOURCE_REPOSITORY           - upstream repository, a GitHub URL, or a disabled value
+#   CI_SYNC_MAIN_SOURCE_REPOSITORY_IS_SET    - "true" when the variable above is declared
+#   CI_SYNC_MAIN_SOURCE_REPOSITORY_DEFAULT   - fallback upstream (default: infinito-nexus/core)
 set -euo pipefail
 
-: "${GITHUB_REPOSITORY:?Missing GITHUB_REPOSITORY}"
+if [[ -z "${GITHUB_REPOSITORY:-}" ]]; then
+	echo origin
+	exit 0
+fi
 
 default_source="${CI_SYNC_MAIN_SOURCE_REPOSITORY_DEFAULT:-infinito-nexus/core}"
 configured_source="${CI_SYNC_MAIN_SOURCE_REPOSITORY:-}"
@@ -18,7 +31,7 @@ source_lower="$(printf '%s' "${source_trimmed}" | tr '[:upper:]' '[:lower:]')"
 
 case "${source_lower}" in
 "" | "false" | "0" | "no" | "off" | "none")
-	echo "Main sync skipped because CI_SYNC_MAIN_SOURCE_REPOSITORY is disabled."
+	echo origin
 	exit 0
 	;;
 esac
@@ -37,7 +50,7 @@ target_repository="$(normalize_repository "${GITHUB_REPOSITORY}")"
 source_repository="$(normalize_repository "${source_trimmed}")"
 
 if [[ "${source_repository}" == "${target_repository}" ]]; then
-	echo "Main sync skipped because source repository matches current repository: ${GITHUB_REPOSITORY}."
+	echo origin
 	exit 0
 fi
 
@@ -46,6 +59,4 @@ if [[ "${source_repository}" != */* ]]; then
 	exit 1
 fi
 
-echo "Syncing ${GITHUB_REPOSITORY}:main from ${source_repository}:main."
-git fetch "https://github.com/${source_repository}.git" main:refs/remotes/main-sync-source/main --force
-git push origin refs/remotes/main-sync-source/main:refs/heads/main --force
+echo "https://github.com/${source_repository}.git"
diff --git a/scripts/meta/resolve/diff/affected_roles.sh b/scripts/meta/resolve/diff/affected_roles.sh
index 696fb528f2..a6beb59ec7 100755
--- a/scripts/meta/resolve/diff/affected_roles.sh
+++ b/scripts/meta/resolve/diff/affected_roles.sh
@@ -55,8 +55,9 @@ emit_all() {
 	exit 0
 }
 
-git fetch --quiet --no-tags --prune --depth=50 origin main >/dev/null 2>&1 ||
-	git fetch --quiet --no-tags --prune origin main
+baseline_remote="$(./scripts/meta/resolve/baseline_remote.sh)"
+git fetch --quiet --no-tags --depth=50 "${baseline_remote}" main:refs/remotes/origin/main --force >/dev/null 2>&1 ||
+	git fetch --quiet --no-tags "${baseline_remote}" main:refs/remotes/origin/main --force
 
 if base="$(git merge-base origin/main HEAD 2>/dev/null)"; then
 	mapfile -t changed_paths < <(git diff --name-only "${base}" HEAD --)
diff --git a/scripts/meta/resolve/diff/new_roles.sh b/scripts/meta/resolve/diff/new_roles.sh
index 9ea2a0d321..60c7721f4e 100755
--- a/scripts/meta/resolve/diff/new_roles.sh
+++ b/scripts/meta/resolve/diff/new_roles.sh
@@ -8,7 +8,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../../../.." && pwd)"
 cd "$REPO_ROOT"
 
-git fetch --quiet --no-tags --prune --depth=50 origin main >/dev/null 2>&1 ||
-	git fetch --quiet --no-tags --prune origin main >/dev/null 2>&1 || true # nocheck: shell-or-true -- baseline fetch is best-effort; a missing origin/main means "no new roles" by contract
+baseline_remote="$(./scripts/meta/resolve/baseline_remote.sh)"
+git fetch --quiet --no-tags --depth=50 "${baseline_remote}" main:refs/remotes/origin/main --force >/dev/null 2>&1 ||
+	git fetch --quiet --no-tags "${baseline_remote}" main:refs/remotes/origin/main --force >/dev/null 2>&1 || true # nocheck: shell-or-true -- baseline fetch is best-effort; a missing origin/main means "no new roles" by contract
 
 "${PYTHON}" -m cli.meta.roles.applications.new_in_branch origin/main
diff --git a/tests/integration/meta/workflows/test_diff_affected_roles.py b/tests/integration/meta/workflows/test_diff_affected_roles.py
index 56473a568c..c0ee2a8bd0 100644
--- a/tests/integration/meta/workflows/test_diff_affected_roles.py
+++ b/tests/integration/meta/workflows/test_diff_affected_roles.py
@@ -13,6 +13,7 @@ from . import PROJECT_ROOT
 
 SCRIPT_REL = Path("scripts/meta/resolve/diff/affected_roles.sh")
 SCRIPT_PATH = PROJECT_ROOT / SCRIPT_REL
+BASELINE_REL = Path("scripts/meta/resolve/baseline_remote.sh")
 
 ROLE_TASKS_MAIN_REL = f"roles/web-app-foo/{ROLE_FILE_TASKS_MAIN}"
 
@@ -57,6 +58,10 @@ class TestDiffAffectedRoles(unittest.TestCase):
         shutil.copy2(SCRIPT_PATH, script_target)
         script_target.chmod(0o755)
 
+        baseline_target = repo / BASELINE_REL
+        shutil.copy2(PROJECT_ROOT / BASELINE_REL, baseline_target)
+        baseline_target.chmod(0o755)
+
         for rel, content in base_files.items():
             dest = repo / rel
             dest.parent.mkdir(parents=True, exist_ok=True)
@@ -92,6 +97,7 @@ class TestDiffAffectedRoles(unittest.TestCase):
         env["INFINITO_DISTRO"] = "test"
         env["PYTHON"] = str(fake_python)
         env.pop("BASH_ENV", None)
+        env.pop("GITHUB_REPOSITORY", None)
 
         return repo, env