diff --git a/.husky/pre-push b/.husky/pre-push
index 7eeeada32..62dd07666 100755
--- a/.husky/pre-push
+++ b/.husky/pre-push
@@ -1,2 +1,20 @@
+# Block pushing version tags directly — releases must go through the GitHub Actions workflow
+# (workflow_dispatch on create-release.yml). Pushing tags manually bypasses the release
+# pipeline which builds binaries, Docker images, and validates assets.
+while read local_ref local_sha remote_ref remote_sha; do
+    if echo "$local_ref" | grep -qE "^refs/tags/v[0-9]"; then
+        echo ""
+        echo "BLOCKED: Direct push of version tag '${local_ref#refs/tags/}' is not allowed."
+        echo ""
+        echo "  Releases must be created via the GitHub Actions release workflow:"
+        echo "    gh workflow run create-release.yml -f version=X.Y.Z -f release_notes=\"...\""
+        echo ""
+        echo "  Pushing tags directly skips the build pipeline and publishes a broken release"
+        echo "  with no binaries, no Docker images, and no checksums."
+        echo ""
+        exit 1
+    fi
+done
+
 # TypeScript type-check before push to prevent CI failures
 cd frontend-modern && npm run type-check
diff --git a/internal/monitoring/monitor_host_agents_test.go b/internal/monitoring/monitor_host_agents_test.go
index d8712290c..6fd662737 100644
--- a/internal/monitoring/monitor_host_agents_test.go
+++ b/internal/monitoring/monitor_host_agents_test.go
@@ -125,6 +125,7 @@ func TestApplyHostReportAllowsTokenReuseAcrossHosts(t *testing.T) {
 		alertManager:      alerts.NewManager(),
 		hostTokenBindings: make(map[string]string),
 		config:            &config.Config{},
+		rateTracker:       NewRateTracker(),
 	}
 	t.Cleanup(func() { monitor.alertManager.Stop() })
 
@@ -189,6 +190,7 @@ func TestApplyHostReportDisambiguatesCollidingIdentifiersAcrossTokens(t *testing
 		alertManager:      alerts.NewManager(),
 		hostTokenBindings: make(map[string]string),
 		config:            &config.Config{},
+		rateTracker:       NewRateTracker(),
 	}
 	t.Cleanup(func() { monitor.alertManager.Stop() })
 
@@ -780,6 +782,7 @@ func TestApplyHostReport_NilTokenBindingsMap(t *testing.T) {
 		alertManager:      alerts.NewManager(),
 		hostTokenBindings: nil, // Nil map
 		config:            &config.Config{},
+		rateTracker:       NewRateTracker(),
 	}
 	t.Cleanup(func() { monitor.alertManager.Stop() })
 
@@ -813,6 +816,7 @@ func TestApplyHostReport_FallbackIdentifier(t *testing.T) {
 		alertManager:      alerts.NewManager(),
 		hostTokenBindings: make(map[string]string),
 		config:            &config.Config{},
+		rateTracker:       NewRateTracker(),
 	}
 	t.Cleanup(func() { monitor.alertManager.Stop() })