diff --git a/.tests/lab/scenarios/30-private-tier.sh b/.tests/lab/scenarios/30-private-tier.sh
index dff7650..af9210a 100644
--- a/.tests/lab/scenarios/30-private-tier.sh
+++ b/.tests/lab/scenarios/30-private-tier.sh
@@ -190,4 +190,16 @@ done
 ls "$HOME/.config/zsh"/.secrets.zsh.* >/dev/null 2>&1 && fail "a temp file survived a failed refresh"
 ok "a failed refresh leaves secrets.zsh byte-identical and no temp file behind"
 
+# ---- GitHub reads stay anonymous https after the tier applies ---------------
+# The tier ships a git@github.com: rewrite for PUSHES. If it ever regresses to
+# a blanket insteadOf, every https clone on a keyless fresh box breaks -- the
+# first casualty was nvim's plugin bootstrap (live, 2026-08-22).
+# Plain `git config --get`, not --global: --global does not follow the
+# [include] seam by default, which made this pair pass vacuously.
+git config --get 'url.git@github.com:.insteadof' >/dev/null 2>&1 \
+	&& fail "GitHub https READS are rewritten to ssh — a keyless box cannot clone plugins"
+git config --get 'url.git@github.com:.pushinsteadof' >/dev/null 2>&1 \
+	|| fail "the GitHub push-over-ssh rewrite is gone entirely"
+ok "GitHub reads stay https; only pushes are rewritten to ssh"
+
 echo "PRIVATE TIER PASS"