diff --git a/scripts/ci b/scripts/ci
index 5c55b36..1f64ec1 100755
--- a/scripts/ci
+++ b/scripts/ci
@@ -29,9 +29,11 @@ run_outside_container() {
     exit 1
   fi
   # Build ci image if needed and run the requested phase inside the container
+  # Important: detach stdin so git hook-provided stdin (ref updates)
+  # doesn't get executed inside the container shell.
   (cd "$root" && docker compose -f docker/ci.compose.yml run --rm \
     -e IN_CI_CONTAINER=1 \
-    ci bash -lc "cd /workspace && scripts/ci --inside ${phase}")
+    ci bash -lc "cd /workspace && scripts/ci --inside ${phase}" </dev/null)
 }
 
 run_format() {
@@ -112,4 +114,3 @@ if [[ "${IN_CI_CONTAINER:-}" != "1" ]]; then
 else
   run_inside_container "$PHASE"
 fi
-