Add and remove ref hooks as needed

Once the cache middleware was removed, it created new failures in CI
that alert us to where ref hook options are needed. This updates those
places and removes places where it is no longer needed due to updates in
internal/git/subcommand.go

58 files changed, 359 insertions, 220 deletions

diff --git a/internal/git/hooks.go b/internal/git/hooks.go
index 0629d052d..97099b859 100644
--- a/internal/git/hooks.go
+++ b/internal/git/hooks.go
@@ -51,20 +51,6 @@ func refHookEnv(ctx context.Context, repo *gitalypb.Repository, cfg config.Cfg)
 	}, nil
 }
 
-type refHookRequired struct{}
-
-// RequireRefHook updates the context to indicate a ref hook is required for
-// the current operation
-func RequireRefHook(ctx context.Context) context.Context {
-	return context.WithValue(ctx, refHookRequired{}, true)
-}
-
-// IsRefHookRequired returns true if the context has been marked to indicate a
-// ref hook may be required
-func IsRefHookRequired(ctx context.Context) bool {
-	return ctx.Value(refHookRequired{}) != nil
-}
-
 // ReceivePackRequest abstracts away the different requests that end up
 // spawning git-receive-pack.
 type ReceivePackRequest interface {
diff --git a/internal/git/objectpool/clone_test.go b/internal/git/objectpool/clone_test.go
index cb10fd01d..90f19c15c 100644
--- a/internal/git/objectpool/clone_test.go
+++ b/internal/git/objectpool/clone_test.go
@@ -16,7 +16,7 @@ func TestClone(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	err = pool.clone(ctx, testRepo)
@@ -34,7 +34,7 @@ func TestCloneExistingPool(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	err = pool.clone(ctx, testRepo)
diff --git a/internal/git/objectpool/fetch.go b/internal/git/objectpool/fetch.go
index 2bcd3a599..4ac559962 100644
--- a/internal/git/objectpool/fetch.go
+++ b/internal/git/objectpool/fetch.go
@@ -17,6 +17,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
 	"gitlab.com/gitlab-org/gitaly/internal/git/updateref"
+	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
@@ -37,7 +38,11 @@ func (o *ObjectPool) FetchFromOrigin(ctx context.Context, origin *gitalypb.Repos
 		return err
 	}
 
-	getRemotes, err := git.SafeCmd(ctx, o, nil, git.SubCmd{Name: "remote"})
+	opts := []git.CmdOpt{
+		git.WithRefTxHook(ctx, helper.ProtoRepoFromRepo(o), o.cfg),
+	}
+
+	getRemotes, err := git.SafeCmd(ctx, o, nil, git.SubCmd{Name: "remote"}, opts...)
 	if err != nil {
 		return err
 	}
@@ -59,7 +64,7 @@ func (o *ObjectPool) FetchFromOrigin(ctx context.Context, origin *gitalypb.Repos
 		setOriginCmd, err = git.SafeCmd(ctx, o, nil, git.SubCmd{
 			Name: "remote",
 			Args: []string{"set-url", sourceRemote, originPath},
-		})
+		}, opts...)
 		if err != nil {
 			return err
 		}
@@ -67,7 +72,7 @@ func (o *ObjectPool) FetchFromOrigin(ctx context.Context, origin *gitalypb.Repos
 		setOriginCmd, err = git.SafeCmd(ctx, o, nil, git.SubCmd{
 			Name: "remote",
 			Args: []string{"add", sourceRemote, originPath},
-		})
+		}, opts...)
 		if err != nil {
 			return err
 		}
@@ -82,11 +87,14 @@ func (o *ObjectPool) FetchFromOrigin(ctx context.Context, origin *gitalypb.Repos
 	}
 
 	refSpec := fmt.Sprintf("+refs/*:%s/*", sourceRefNamespace)
-	fetchCmd, err := git.SafeCmd(ctx, o, nil, git.SubCmd{
-		Name:  "fetch",
-		Flags: []git.Option{git.Flag{Name: "--quiet"}},
-		Args:  []string{sourceRemote, refSpec},
-	})
+	fetchCmd, err := git.SafeCmd(ctx, o, nil,
+		git.SubCmd{
+			Name:  "fetch",
+			Flags: []git.Option{git.Flag{Name: "--quiet"}},
+			Args:  []string{sourceRemote, refSpec},
+		},
+		opts...,
+	)
 	if err != nil {
 		return err
 	}
diff --git a/internal/git/objectpool/fetch_test.go b/internal/git/objectpool/fetch_test.go
index 4998d2b3a..d3338e785 100644
--- a/internal/git/objectpool/fetch_test.go
+++ b/internal/git/objectpool/fetch_test.go
@@ -18,7 +18,7 @@ func TestFetchFromOriginDangling(t *testing.T) {
 	source, _, cleanup := testhelper.NewTestRepo(t)
 	defer cleanup()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	ctx, cancel := testhelper.Context()
@@ -90,7 +90,7 @@ func TestFetchFromOriginDeltaIslands(t *testing.T) {
 	source, sourcePath, cleanup := testhelper.NewTestRepo(t)
 	defer cleanup()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	ctx, cancel := testhelper.Context()
@@ -116,7 +116,7 @@ func TestFetchFromOriginBitmapHashCache(t *testing.T) {
 	source, _, cleanup := testhelper.NewTestRepo(t)
 	defer cleanup()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	ctx, cancel := testhelper.Context()
@@ -145,7 +145,7 @@ func TestFetchFromOriginRefUpdates(t *testing.T) {
 	source, sourcePath, cleanup := testhelper.NewTestRepo(t)
 	defer cleanup()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), source.StorageName, testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	poolPath := pool.FullPath()
 
diff --git a/internal/git/objectpool/link.go b/internal/git/objectpool/link.go
index 8f845d813..ea48e2787 100644
--- a/internal/git/objectpool/link.go
+++ b/internal/git/objectpool/link.go
@@ -168,8 +168,8 @@ func (o *ObjectPool) Unlink(ctx context.Context, repo *gitalypb.Repository) erro
 	// We need to use removeRemote, and can't leverage `git config --remove-section`
 	// as the latter doesn't clean up refs
 	remoteName := repo.GetGlRepository()
-	if err := remote.Remove(ctx, o, remoteName); err != nil {
-		if present, err2 := remote.Exists(ctx, o, remoteName); err2 != nil || present {
+	if err := remote.Remove(ctx, o.cfg, o, remoteName); err != nil {
+		if present, err2 := remote.Exists(ctx, o.cfg, o, remoteName); err2 != nil || present {
 			return err
 		}
 	}
diff --git a/internal/git/objectpool/pool.go b/internal/git/objectpool/pool.go
index 9cef00394..2f9fc4b09 100644
--- a/internal/git/objectpool/pool.go
+++ b/internal/git/objectpool/pool.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/storage"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -32,6 +33,7 @@ const ErrInvalidPoolDir errString = "invalid object pool directory"
 // live in a pool in a distinct repository which is used as an alternate object
 // store for other repositories.
 type ObjectPool struct {
+	cfg         config.Cfg
 	locator     storage.Locator
 	storageName string
 	storagePath string
@@ -42,7 +44,7 @@ type ObjectPool struct {
 // NewObjectPool will initialize the object with the required data on the storage
 // shard. Relative path is validated to match the expected naming and directory
 // structure. If the shard cannot be found, this function returns an error.
-func NewObjectPool(locator storage.Locator, storageName, relativePath string) (pool *ObjectPool, err error) {
+func NewObjectPool(cfg config.Cfg, locator storage.Locator, storageName, relativePath string) (pool *ObjectPool, err error) {
 	storagePath, err := helper.GetStorageByName(storageName)
 	if err != nil {
 		return nil, err
@@ -53,7 +55,7 @@ func NewObjectPool(locator storage.Locator, storageName, relativePath string) (p
 		return nil, ErrInvalidPoolDir
 	}
 
-	return &ObjectPool{locator: locator, storageName: storageName, storagePath: storagePath, relativePath: relativePath}, nil
+	return &ObjectPool{cfg: cfg, locator: locator, storageName: storageName, storagePath: storagePath, relativePath: relativePath}, nil
 }
 
 // GetGitAlternateObjectDirectories for object pools are empty, given pools are
@@ -140,7 +142,7 @@ func (o *ObjectPool) Init(ctx context.Context) (err error) {
 }
 
 // FromRepo returns an instance of ObjectPool that the repository points to
-func FromRepo(locator storage.Locator, repo *gitalypb.Repository) (*ObjectPool, error) {
+func FromRepo(cfg config.Cfg, locator storage.Locator, repo *gitalypb.Repository) (*ObjectPool, error) {
 	dir, err := getAlternateObjectDir(locator, repo)
 	if err != nil {
 		return nil, err
@@ -160,7 +162,7 @@ func FromRepo(locator storage.Locator, repo *gitalypb.Repository) (*ObjectPool,
 		return nil, err
 	}
 
-	return NewObjectPool(locator, repo.GetStorageName(), filepath.Dir(altPathRelativeToStorage))
+	return NewObjectPool(cfg, locator, repo.GetStorageName(), filepath.Dir(altPathRelativeToStorage))
 }
 
 var (
diff --git a/internal/git/objectpool/pool_test.go b/internal/git/objectpool/pool_test.go
index 2a2dd2c54..3149cfa03 100644
--- a/internal/git/objectpool/pool_test.go
+++ b/internal/git/objectpool/pool_test.go
@@ -14,10 +14,10 @@ import (
 )
 
 func TestNewObjectPool(t *testing.T) {
-	_, err := NewObjectPool(nil, "default", testhelper.NewTestObjectPoolName(t))
+	_, err := NewObjectPool(config.Config, config.NewLocator(config.Config), "default", testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
-	_, err = NewObjectPool(nil, "mepmep", testhelper.NewTestObjectPoolName(t))
+	_, err = NewObjectPool(config.Config, config.NewLocator(config.Config), "mepmep", testhelper.NewTestObjectPoolName(t))
 	require.Error(t, err, "creating pool in storage that does not exist should fail")
 }
 
@@ -27,9 +27,8 @@ func TestNewFromRepoSuccess(t *testing.T) {
 	defer cleanup()
 
 	relativePoolPath := testhelper.NewTestObjectPoolName(t)
-	locator := config.NewLocator(config.Config)
 
-	pool, err := NewObjectPool(locator, testRepo.GetStorageName(), relativePoolPath)
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), relativePoolPath)
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -37,7 +36,7 @@ func TestNewFromRepoSuccess(t *testing.T) {
 	require.NoError(t, pool.Create(ctx, testRepo))
 	require.NoError(t, pool.Link(ctx, testRepo))
 
-	poolFromRepo, err := FromRepo(locator, testRepo)
+	poolFromRepo, err := FromRepo(config.Config, config.NewLocator(config.Config), testRepo)
 	require.NoError(t, err)
 	require.Equal(t, relativePoolPath, poolFromRepo.relativePath)
 	require.Equal(t, pool.storageName, poolFromRepo.storageName)
@@ -47,10 +46,8 @@ func TestNewFromRepoNoObjectPool(t *testing.T) {
 	testRepo, testRepoPath, cleanup := testhelper.NewTestRepo(t)
 	defer cleanup()
 
-	locator := config.NewLocator(config.Config)
-
 	// no alternates file
-	poolFromRepo, err := FromRepo(locator, testRepo)
+	poolFromRepo, err := FromRepo(config.Config, config.NewLocator(config.Config), testRepo)
 	require.Equal(t, ErrAlternateObjectDirNotExist, err)
 	require.Nil(t, poolFromRepo)
 
@@ -83,7 +80,7 @@ func TestNewFromRepoNoObjectPool(t *testing.T) {
 		t.Run(tc.desc, func(t *testing.T) {
 			alternateFilePath := filepath.Join(testRepoPath, "objects", "info", "alternates")
 			require.NoError(t, ioutil.WriteFile(alternateFilePath, tc.fileContent, 0644))
-			poolFromRepo, err := FromRepo(locator, testRepo)
+			poolFromRepo, err := FromRepo(config.Config, config.NewLocator(config.Config), testRepo)
 			require.Equal(t, tc.expectedErr, err)
 			require.Nil(t, poolFromRepo)
 
@@ -101,7 +98,7 @@ func TestCreate(t *testing.T) {
 
 	masterSha := testhelper.MustRunCommand(t, nil, "git", "-C", testRepoPath, "show-ref", "master")
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	err = pool.Create(ctx, testRepo)
@@ -134,7 +131,7 @@ func TestCreateSubDirsExist(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	defer pool.Remove(ctx)
 	require.NoError(t, err)
 
@@ -155,7 +152,7 @@ func TestRemove(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := NewObjectPool(config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	err = pool.Create(ctx, testRepo)
diff --git a/internal/git/objectpool/proto.go b/internal/git/objectpool/proto.go
index 1e69f5a50..caa3db344 100644
--- a/internal/git/objectpool/proto.go
+++ b/internal/git/objectpool/proto.go
@@ -1,13 +1,14 @@
 package objectpool
 
 import (
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/storage"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
 // FromProto returns an object pool object from a git repository object
-func FromProto(locator storage.Locator, o *gitalypb.ObjectPool) (*ObjectPool, error) {
-	return NewObjectPool(locator, o.GetRepository().GetStorageName(), o.GetRepository().GetRelativePath())
+func FromProto(cfg config.Cfg, locator storage.Locator, o *gitalypb.ObjectPool) (*ObjectPool, error) {
+	return NewObjectPool(cfg, locator, o.GetRepository().GetStorageName(), o.GetRepository().GetRelativePath())
 }
 
 // ToProto returns a new struct that is the protobuf definition of the ObjectPool
diff --git a/internal/git/objectpool/testhelper_test.go b/internal/git/objectpool/testhelper_test.go
index 21eef190a..49b5d19ea 100644
--- a/internal/git/objectpool/testhelper_test.go
+++ b/internal/git/objectpool/testhelper_test.go
@@ -16,7 +16,7 @@ func TestMain(m *testing.M) {
 }
 
 func NewTestObjectPool(ctx context.Context, t *testing.T, storageName string) (*ObjectPool, func()) {
-	pool, err := NewObjectPool(config.NewLocator(config.Config), storageName, testhelper.NewTestObjectPoolName(t))
+	pool, err := NewObjectPool(config.Config, config.NewLocator(config.Config), storageName, testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	return pool, func() {
 		require.NoError(t, pool.Remove(ctx))
diff --git a/internal/git/remote.go b/internal/git/remote.go
index 79bc86123..399342024 100644
--- a/internal/git/remote.go
+++ b/internal/git/remote.go
@@ -9,6 +9,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/client"
 	"gitlab.com/gitlab-org/gitaly/internal/command"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/storage"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -192,6 +193,7 @@ func (repo RepositoryRemote) Add(ctx context.Context, name, url string, opts Rem
 			Args:  []string{name, url},
 		},
 		WithStderr(&stderr),
+		WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo.repo), config.Config),
 	)
 	if err != nil {
 		return err
@@ -229,6 +231,7 @@ func (repo RepositoryRemote) Remove(ctx context.Context, name string) error {
 			Args:  []string{name},
 		},
 		WithStderr(&stderr),
+		WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo.repo), config.Config),
 	)
 	if err != nil {
 		return err
@@ -284,6 +287,7 @@ func (repo RepositoryRemote) SetURL(ctx context.Context, name, url string, opts
 			Args:  []string{name, url},
 		},
 		WithStderr(&stderr),
+		WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo.repo), config.Config),
 	)
 	if err != nil {
 		return err
diff --git a/internal/git/remote/remote.go b/internal/git/remote/remote.go
index 41e83b187..a21bb5af7 100644
--- a/internal/git/remote/remote.go
+++ b/internal/git/remote/remote.go
@@ -6,15 +6,17 @@ import (
 
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/helper"
 )
 
 //Remove removes the remote from repository
-func Remove(ctx context.Context, repo repository.GitRepo, name string) error {
+func Remove(ctx context.Context, cfg config.Cfg, repo repository.GitRepo, name string) error {
 	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
 		Name:  "remote",
 		Flags: []git.Option{git.SubSubCmd{Name: "remove"}},
 		Args:  []string{name},
-	})
+	}, git.WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo), cfg))
 	if err != nil {
 		return err
 	}
@@ -24,8 +26,11 @@ func Remove(ctx context.Context, repo repository.GitRepo, name string) error {
 
 // Exists will always return a boolean value, but should only be depended on
 // when the error value is nil
-func Exists(ctx context.Context, repo repository.GitRepo, name string) (bool, error) {
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{Name: "remote"})
+func Exists(ctx context.Context, cfg config.Cfg, repo repository.GitRepo, name string) (bool, error) {
+	cmd, err := git.SafeCmd(ctx, repo, nil,
+		git.SubCmd{Name: "remote"},
+		git.WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo), cfg),
+	)
 	if err != nil {
 		return false, err
 	}
diff --git a/internal/git/remote/remote_test.go b/internal/git/remote/remote_test.go
index 99a963741..b84588850 100644
--- a/internal/git/remote/remote_test.go
+++ b/internal/git/remote/remote_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 )
 
@@ -22,7 +23,7 @@ func TestRemoveRemote(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	require.NoError(t, Remove(ctx, testRepo, "origin"))
+	require.NoError(t, Remove(ctx, config.Config, testRepo, "origin"))
 
 	repoPath := filepath.Join(testhelper.GitlabTestStoragePath(), testRepo.RelativePath)
 
@@ -45,7 +46,7 @@ func TestRemoveRemoteDontRemoveLocalBranches(t *testing.T) {
 
 	masterBeforeRemove := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "show-ref", "refs/heads/master")
 
-	require.NoError(t, Remove(ctx, testRepo, "origin"))
+	require.NoError(t, Remove(ctx, config.Config, testRepo, "origin"))
 
 	out := testhelper.MustRunCommand(t, nil, "git", "-C", repoPath, "remote")
 	require.Len(t, out, 0)
@@ -61,11 +62,11 @@ func TestRemoteExists(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	found, err := Exists(ctx, testRepo, "origin")
+	found, err := Exists(ctx, config.Config, testRepo, "origin")
 	require.NoError(t, err)
 	require.True(t, found)
 
-	found, err = Exists(ctx, testRepo, "can-not-be-found")
+	found, err = Exists(ctx, config.Config, testRepo, "can-not-be-found")
 	require.NoError(t, err)
 	require.False(t, found)
 }
diff --git a/internal/git/repository.go b/internal/git/repository.go
index a8a23099b..81a433192 100644
--- a/internal/git/repository.go
+++ b/internal/git/repository.go
@@ -12,6 +12,8 @@ import (
 
 	"gitlab.com/gitlab-org/gitaly/internal/command"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/text"
 )
 
@@ -388,10 +390,14 @@ func (repo *localRepository) GetBranches(ctx context.Context) ([]Reference, erro
 }
 
 func (repo *localRepository) UpdateRef(ctx context.Context, reference, newrev, oldrev string) error {
-	cmd, err := repo.command(ctx, nil, SubCmd{
-		Name:  "update-ref",
-		Flags: []Option{Flag{Name: "-z"}, Flag{Name: "--stdin"}},
-	}, WithStdin(strings.NewReader(fmt.Sprintf("update %s\x00%s\x00%s\x00", reference, newrev, oldrev))))
+	cmd, err := repo.command(ctx, nil,
+		SubCmd{
+			Name:  "update-ref",
+			Flags: []Option{Flag{Name: "-z"}, Flag{Name: "--stdin"}},
+		},
+		WithStdin(strings.NewReader(fmt.Sprintf("update %s\x00%s\x00%s\x00", reference, newrev, oldrev))),
+		WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo.repo), config.Config),
+	)
 	if err != nil {
 		return err
 	}
@@ -415,6 +421,7 @@ func (repo *localRepository) FetchRemote(ctx context.Context, remoteName string,
 			Args:  []string{remoteName},
 		},
 		WithStderr(opts.Stderr),
+		WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo.repo), config.Config),
 	)
 	if err != nil {
 		return err
diff --git a/internal/git/safecmd.go b/internal/git/safecmd.go
index d88c29513..d7f011a51 100644
--- a/internal/git/safecmd.go
+++ b/internal/git/safecmd.go
@@ -274,7 +274,7 @@ func handleOpts(ctx context.Context, sc Cmd, cc *cmdCfg, opts []CmdOpt) error {
 		}
 	}
 
-	if IsRefHookRequired(ctx) && !cc.refHookConfigured && mayUpdateRef(sc.Subcommand()) {
+	if !cc.refHookConfigured && mayUpdateRef(sc.Subcommand()) {
 		return fmt.Errorf("subcommand %q: %w", sc.Subcommand(), ErrRefHookRequired)
 	}
 	if cc.refHookConfigured && !mayUpdateRef(sc.Subcommand()) {
diff --git a/internal/git/safecmd_test.go b/internal/git/safecmd_test.go
index 9c60ab1cf..735b34d61 100644
--- a/internal/git/safecmd_test.go
+++ b/internal/git/safecmd_test.go
@@ -112,6 +112,7 @@ func TestSafeCmdInvalidArg(t *testing.T) {
 			&gitalypb.Repository{},
 			tt.globals,
 			tt.subCmd,
+			git.WithRefTxHook(context.Background(), &gitalypb.Repository{}, config.Config),
 		)
 		require.EqualError(t, err, tt.errMsg)
 		require.True(t, git.IsInvalidArgErr(err))
@@ -198,21 +199,22 @@ func TestSafeCmdValid(t *testing.T) {
 			expectArgs: []string{"--contributing", "--author", "a-gopher", "accept", "--is-important", "--why", "looking-for-first-contribution", "mr", endOfOptions},
 		},
 	} {
-		cmd, err := git.SafeCmd(ctx, testRepo, tt.globals, tt.subCmd)
+		opts := []git.CmdOpt{git.WithRefTxHook(ctx, &gitalypb.Repository{}, config.Config)}
+		cmd, err := git.SafeCmd(ctx, testRepo, tt.globals, tt.subCmd, opts...)
 		require.NoError(t, err)
 		// ignore first 3 indeterministic args (executable path and repo args)
 		require.Equal(t, tt.expectArgs, cmd.Args()[3:])
 
-		cmd, err = git.SafeCmdWithEnv(ctx, nil, testRepo, tt.globals, tt.subCmd)
+		cmd, err = git.SafeCmdWithEnv(ctx, nil, testRepo, tt.globals, tt.subCmd, opts...)
 		require.NoError(t, err)
 		// ignore first 3 indeterministic args (executable path and repo args)
 		require.Equal(t, tt.expectArgs, cmd.Args()[3:])
 
-		cmd, err = git.SafeStdinCmd(ctx, testRepo, tt.globals, tt.subCmd)
+		cmd, err = git.SafeStdinCmd(ctx, testRepo, tt.globals, tt.subCmd, opts...)
 		require.NoError(t, err)
 		require.Equal(t, tt.expectArgs, cmd.Args()[3:])
 
-		cmd, err = git.SafeBareCmd(ctx, git.CmdStream{}, nil, tt.globals, tt.subCmd)
+		cmd, err = git.SafeBareCmd(ctx, git.CmdStream{}, nil, tt.globals, tt.subCmd, opts...)
 		require.NoError(t, err)
 		// ignore first indeterministic arg (executable path)
 		require.Equal(t, tt.expectArgs, cmd.Args()[1:])
@@ -243,7 +245,8 @@ func TestSafeCmdWithEnv(t *testing.T) {
 
 	env := []string{"TEST_VAR1=1", "TEST_VAR2=2"}
 
-	cmd, err := git.SafeCmdWithEnv(ctx, env, testRepo, globals, subCmd)
+	opts := []git.CmdOpt{git.WithRefTxHook(ctx, &gitalypb.Repository{}, config.Config)}
+	cmd, err := git.SafeCmdWithEnv(ctx, env, testRepo, globals, subCmd, opts...)
 	require.NoError(t, err)
 	// ignore first 3 indeterministic args (executable path and repo args)
 	require.Equal(t, expectArgs, cmd.Args()[3:])
diff --git a/internal/git/subcommand.go b/internal/git/subcommand.go
index 902bc7760..0a837723b 100644
--- a/internal/git/subcommand.go
+++ b/internal/git/subcommand.go
@@ -13,16 +13,41 @@ const (
 	scDiff           = "diff"
 	scPackRefs       = "pack-refs"
 	scMergeBase      = "merge-base"
+	scHashObject     = "hash-object"
+	scShowRef        = "show-ref"
+	scUploadPack     = "upload-pack"
+	scUploadArchive  = "upload-archive"
+	scBlame          = "blame"
+	scLsTree         = "ls-tree"
+	scRevList        = "rev-list"
+	scLsRemote       = "ls-remote"
+	scFsck           = "fsck"
+	scGrep           = "grep"
+	scBundle         = "bundle"
+	scArchive        = "archive"
+	scFormatPatch    = "format-patch"
 )
 
 var knownReadOnlyCmds = map[string]struct{}{
-	scCatFile:      struct{}{},
-	scLog:          struct{}{},
-	scForEachRef:   struct{}{},
-	scRevParse:     struct{}{},
-	scCountObjects: struct{}{},
-	scDiff:         struct{}{},
-	scMergeBase:    struct{}{},
+	scCatFile:       struct{}{},
+	scLog:           struct{}{},
+	scForEachRef:    struct{}{},
+	scRevParse:      struct{}{},
+	scCountObjects:  struct{}{},
+	scDiff:          struct{}{},
+	scMergeBase:     struct{}{},
+	scShowRef:       struct{}{},
+	scUploadPack:    struct{}{},
+	scUploadArchive: struct{}{},
+	scBlame:         struct{}{},
+	scLsTree:        struct{}{},
+	scRevList:       struct{}{},
+	scLsRemote:      struct{}{},
+	scFsck:          struct{}{},
+	scGrep:          struct{}{},
+	scBundle:        struct{}{},
+	scArchive:       struct{}{},
+	scFormatPatch:   struct{}{},
 }
 
 // knownNoRefUpdates indicates all repo mutating commands where it is known
@@ -32,6 +57,7 @@ var knownNoRefUpdates = map[string]struct{}{
 	scMultiPackIndex: struct{}{},
 	scRepack:         struct{}{},
 	scPackRefs:       struct{}{},
+	scHashObject:     struct{}{},
 }
 
 // mayUpdateRef indicates if a subcommand is known to update references.
diff --git a/internal/git/updateref/updateref.go b/internal/git/updateref/updateref.go
index 10d9901ca..20c3c7498 100644
--- a/internal/git/updateref/updateref.go
+++ b/internal/git/updateref/updateref.go
@@ -7,6 +7,8 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/command"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/helper"
 )
 
 // Updater wraps a `git update-ref --stdin` process, presenting an interface
@@ -24,10 +26,13 @@ type Updater struct {
 // It is important that ctx gets canceled somewhere. If it doesn't, the process
 // spawned by New() may never terminate.
 func New(ctx context.Context, repo repository.GitRepo) (*Updater, error) {
-	cmd, err := git.SafeStdinCmd(ctx, repo, nil, git.SubCmd{
-		Name:  "update-ref",
-		Flags: []git.Option{git.Flag{Name: "-z"}, git.Flag{Name: "--stdin"}},
-	})
+	cmd, err := git.SafeStdinCmd(ctx, repo, nil,
+		git.SubCmd{
+			Name:  "update-ref",
+			Flags: []git.Option{git.Flag{Name: "-z"}, git.Flag{Name: "--stdin"}},
+		},
+		git.WithRefTxHook(ctx, helper.ProtoRepoFromRepo(repo), config.Config),
+	)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/gitaly/service/objectpool/alternates_test.go b/internal/gitaly/service/objectpool/alternates_test.go
index f9ff064e2..7db5629a9 100644
--- a/internal/gitaly/service/objectpool/alternates_test.go
+++ b/internal/gitaly/service/objectpool/alternates_test.go
@@ -9,13 +9,13 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
-	gconfig "gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
 func TestDisconnectGitAlternates(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -28,7 +28,7 @@ func TestDisconnectGitAlternates(t *testing.T) {
 	testRepo, testRepoPath, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -65,7 +65,7 @@ func TestDisconnectGitAlternates(t *testing.T) {
 }
 
 func TestDisconnectGitAlternatesNoAlternates(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -89,7 +89,7 @@ func TestDisconnectGitAlternatesNoAlternates(t *testing.T) {
 }
 
 func TestDisconnectGitAlternatesUnexpectedAlternates(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -135,7 +135,7 @@ func TestRemoveAlternatesIfOk(t *testing.T) {
 	testRepo, testRepoPath, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	altPath, err := locator.InfoAlternatesPath(testRepo)
 	require.NoError(t, err, "find info/alternates")
 	altContent := "/var/empty\n"
diff --git a/internal/gitaly/service/objectpool/create.go b/internal/gitaly/service/objectpool/create.go
index 407e56287..8815302fb 100644
--- a/internal/gitaly/service/objectpool/create.go
+++ b/internal/gitaly/service/objectpool/create.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
@@ -67,7 +68,7 @@ func (s *server) poolForRequest(req poolRequest) (*objectpool.ObjectPool, error)
 		return nil, errMissingPool
 	}
 
-	pool, err := objectpool.NewObjectPool(s.locator, poolRepo.GetStorageName(), poolRepo.GetRelativePath())
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), poolRepo.GetStorageName(), poolRepo.GetRelativePath())
 	if err != nil {
 		if err == objectpool.ErrInvalidPoolDir {
 			return nil, errInvalidPoolDir
diff --git a/internal/gitaly/service/objectpool/create_test.go b/internal/gitaly/service/objectpool/create_test.go
index 69bfeb0f1..04cb848cb 100644
--- a/internal/gitaly/service/objectpool/create_test.go
+++ b/internal/gitaly/service/objectpool/create_test.go
@@ -29,7 +29,7 @@ func TestCreate(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, "default", testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	poolReq := &gitalypb.CreateObjectPoolRequest{
@@ -77,7 +77,7 @@ func TestUnsuccessfulCreate(t *testing.T) {
 	defer cleanupFn()
 
 	validPoolPath := testhelper.NewTestObjectPoolName(t)
-	pool, err := objectpool.NewObjectPool(locator, "default", validPoolPath)
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", validPoolPath)
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -177,7 +177,7 @@ func TestDelete(t *testing.T) {
 	defer cleanupFn()
 
 	validPoolPath := testhelper.NewTestObjectPoolName(t)
-	pool, err := objectpool.NewObjectPool(locator, "default", validPoolPath)
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", validPoolPath)
 	require.NoError(t, err)
 	require.NoError(t, pool.Create(ctx, testRepo))
 
diff --git a/internal/gitaly/service/objectpool/fetch_into_object_pool.go b/internal/gitaly/service/objectpool/fetch_into_object_pool.go
index e289dccd8..cf1c44482 100644
--- a/internal/gitaly/service/objectpool/fetch_into_object_pool.go
+++ b/internal/gitaly/service/objectpool/fetch_into_object_pool.go
@@ -7,6 +7,7 @@ import (
 
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
 	"gitlab.com/gitlab-org/gitaly/internal/git/stats"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
@@ -16,7 +17,7 @@ func (s *server) FetchIntoObjectPool(ctx context.Context, req *gitalypb.FetchInt
 		return nil, helper.ErrInvalidArgument(err)
 	}
 
-	objectPool, err := objectpool.FromProto(s.locator, req.GetObjectPool())
+	objectPool, err := objectpool.FromProto(config.Config, config.NewLocator(config.Config), req.GetObjectPool())
 	if err != nil {
 		return nil, helper.ErrInvalidArgument(fmt.Errorf("object pool invalid: %v", err))
 	}
diff --git a/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go b/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
index b3503381e..71bd8533c 100644
--- a/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
+++ b/internal/gitaly/service/objectpool/fetch_into_object_pool_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
-	gconfig "gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/labkit/log"
@@ -20,7 +20,7 @@ import (
 )
 
 func TestFetchIntoObjectPool_Success(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -35,7 +35,7 @@ func TestFetchIntoObjectPool_Success(t *testing.T) {
 
 	repoCommit := testhelper.CreateCommit(t, testRepoPath, t.Name(), &testhelper.CreateCommitOpts{Message: t.Name()})
 
-	pool, err := objectpool.NewObjectPool(locator, "default", testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -79,7 +79,7 @@ func TestFetchIntoObjectPool_CollectLogStatistics(t *testing.T) {
 	defer cancel()
 	ctx = ctxlogrus.ToContext(ctx, log.WithField("test", "logging"))
 
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -89,7 +89,7 @@ func TestFetchIntoObjectPool_CollectLogStatistics(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, "default", testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -118,7 +118,7 @@ func TestFetchIntoObjectPool_CollectLogStatistics(t *testing.T) {
 }
 
 func TestFetchIntoObjectPool_Failure(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server := NewServer(locator)
 
 	ctx, cancel := testhelper.Context()
@@ -127,7 +127,7 @@ func TestFetchIntoObjectPool_Failure(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, "default", testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), "default", testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
diff --git a/internal/gitaly/service/objectpool/get.go b/internal/gitaly/service/objectpool/get.go
index c409ee869..70a775610 100644
--- a/internal/gitaly/service/objectpool/get.go
+++ b/internal/gitaly/service/objectpool/get.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
@@ -15,7 +16,7 @@ func (s *server) GetObjectPool(ctx context.Context, in *gitalypb.GetObjectPoolRe
 		return nil, helper.ErrInternal(errors.New("repository is empty"))
 	}
 
-	objectPool, err := objectpool.FromRepo(s.locator, in.GetRepository())
+	objectPool, err := objectpool.FromRepo(config.Config, config.NewLocator(config.Config), in.GetRepository())
 
 	if err != nil {
 		ctxlogrus.Extract(ctx).
diff --git a/internal/gitaly/service/objectpool/get_test.go b/internal/gitaly/service/objectpool/get_test.go
index 7294daa53..5cc12bda0 100644
--- a/internal/gitaly/service/objectpool/get_test.go
+++ b/internal/gitaly/service/objectpool/get_test.go
@@ -8,13 +8,13 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
-	gconfig "gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
 func TestGetObjectPoolSuccess(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -26,7 +26,7 @@ func TestGetObjectPoolSuccess(t *testing.T) {
 
 	relativePoolPath := testhelper.NewTestObjectPoolName(t)
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), relativePoolPath)
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), relativePoolPath)
 	require.NoError(t, err)
 
 	poolCtx, cancel := testhelper.Context()
@@ -47,7 +47,7 @@ func TestGetObjectPoolSuccess(t *testing.T) {
 }
 
 func TestGetObjectPoolNoFile(t *testing.T) {
-	server, serverSocketPath := runObjectPoolServer(t, gconfig.NewLocator(gconfig.Config))
+	server, serverSocketPath := runObjectPoolServer(t, config.NewLocator(config.Config))
 	defer server.Stop()
 
 	client, conn := newObjectPoolClient(t, serverSocketPath)
@@ -68,7 +68,7 @@ func TestGetObjectPoolNoFile(t *testing.T) {
 }
 
 func TestGetObjectPoolBadFile(t *testing.T) {
-	server, serverSocketPath := runObjectPoolServer(t, gconfig.NewLocator(gconfig.Config))
+	server, serverSocketPath := runObjectPoolServer(t, config.NewLocator(config.Config))
 	defer server.Stop()
 
 	client, conn := newObjectPoolClient(t, serverSocketPath)
diff --git a/internal/gitaly/service/objectpool/link_test.go b/internal/gitaly/service/objectpool/link_test.go
index 1a71288bb..b4aa0fea5 100644
--- a/internal/gitaly/service/objectpool/link_test.go
+++ b/internal/gitaly/service/objectpool/link_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git/log"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
-	gconfig "gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/storage"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -17,7 +17,7 @@ import (
 )
 
 func TestLink(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -30,7 +30,7 @@ func TestLink(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	require.NoError(t, pool.Remove(ctx), "make sure pool does not exist at start of test")
@@ -91,7 +91,7 @@ func TestLink(t *testing.T) {
 }
 
 func TestLinkIdempotent(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -104,7 +104,7 @@ func TestLinkIdempotent(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 	require.NoError(t, pool.Create(ctx, testRepo))
@@ -122,7 +122,7 @@ func TestLinkIdempotent(t *testing.T) {
 }
 
 func TestLinkNoClobber(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -135,7 +135,7 @@ func TestLinkNoClobber(t *testing.T) {
 	testRepo, testRepoPath, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -162,7 +162,7 @@ func TestLinkNoClobber(t *testing.T) {
 }
 
 func TestLinkNoPool(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -175,7 +175,7 @@ func TestLinkNoPool(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	// intentionally do not call pool.Create
 	defer pool.Remove(ctx)
@@ -195,7 +195,7 @@ func TestLinkNoPool(t *testing.T) {
 }
 
 func TestUnlink(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -211,7 +211,7 @@ func TestUnlink(t *testing.T) {
 	deletedRepo, deletedRepoPath, removeDeletedRepo := testhelper.NewTestRepo(t)
 	defer removeDeletedRepo()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 
@@ -222,7 +222,7 @@ func TestUnlink(t *testing.T) {
 	removeDeletedRepo()
 	testhelper.AssertPathNotExists(t, deletedRepoPath)
 
-	pool2, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool2, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	require.NoError(t, pool2.Create(ctx, testRepo), "create pool 2")
 	defer pool2.Remove(ctx)
@@ -308,7 +308,7 @@ func TestUnlink(t *testing.T) {
 }
 
 func TestUnlinkIdempotent(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -321,7 +321,7 @@ func TestUnlinkIdempotent(t *testing.T) {
 	testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 	require.NoError(t, pool.Create(ctx, testRepo))
diff --git a/internal/gitaly/service/objectpool/reduplicate_test.go b/internal/gitaly/service/objectpool/reduplicate_test.go
index c5b197126..597bdd4e7 100644
--- a/internal/gitaly/service/objectpool/reduplicate_test.go
+++ b/internal/gitaly/service/objectpool/reduplicate_test.go
@@ -7,13 +7,13 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
-	gconfig "gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
 func TestReduplicate(t *testing.T) {
-	locator := gconfig.NewLocator(gconfig.Config)
+	locator := config.NewLocator(config.Config)
 	server, serverSocketPath := runObjectPoolServer(t, locator)
 	defer server.Stop()
 
@@ -26,7 +26,7 @@ func TestReduplicate(t *testing.T) {
 	testRepo, testRepoPath, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(locator, testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), testRepo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 	defer pool.Remove(ctx)
 	require.NoError(t, pool.Create(ctx, testRepo))
diff --git a/internal/gitaly/service/operations/commit_files.go b/internal/gitaly/service/operations/commit_files.go
index 961efdf70..47409224a 100644
--- a/internal/gitaly/service/operations/commit_files.go
+++ b/internal/gitaly/service/operations/commit_files.go
@@ -381,6 +381,7 @@ func (s *server) fetchRemoteObject(ctx context.Context, local, remote *gitalypb.
 			Args:  []string{"ssh://gitaly/internal.git", sha},
 		},
 		git.WithStderr(stderr),
+		git.WithRefTxHook(ctx, local, s.cfg),
 	)
 	if err != nil {
 		return err
diff --git a/internal/gitaly/service/operations/squash.go b/internal/gitaly/service/operations/squash.go
index 8d7309c47..161c1b71f 100644
--- a/internal/gitaly/service/operations/squash.go
+++ b/internal/gitaly/service/operations/squash.go
@@ -313,7 +313,11 @@ func (s *server) addWorktree(ctx context.Context, repo *gitalypb.Repository, wor
 	}
 
 	var stderr bytes.Buffer
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{Name: "worktree", Flags: flags, Args: args}, git.WithStderr(&stderr))
+	cmd, err := git.SafeCmd(ctx, repo, nil,
+		git.SubCmd{Name: "worktree", Flags: flags, Args: args},
+		git.WithStderr(&stderr),
+		git.WithRefTxHook(ctx, repo, s.cfg),
+	)
 	if err != nil {
 		return fmt.Errorf("creation of 'git worktree add': %w", gitError{ErrMsg: stderr.String(), Err: err})
 	}
@@ -326,11 +330,14 @@ func (s *server) addWorktree(ctx context.Context, repo *gitalypb.Repository, wor
 }
 
 func (s *server) removeWorktree(ctx context.Context, repo *gitalypb.Repository, worktreeName string) error {
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
-		Name:  "worktree",
-		Flags: []git.Option{git.SubSubCmd{Name: "remove"}, git.Flag{Name: "--force"}},
-		Args:  []string{worktreeName},
-	})
+	cmd, err := git.SafeCmd(ctx, repo, nil,
+		git.SubCmd{
+			Name:  "worktree",
+			Flags: []git.Option{git.SubSubCmd{Name: "remove"}, git.Flag{Name: "--force"}},
+			Args:  []string{worktreeName},
+		},
+		git.WithRefTxHook(ctx, repo, s.cfg),
+	)
 	if err != nil {
 		return fmt.Errorf("creation of 'worktree remove': %w", err)
 	}
diff --git a/internal/gitaly/service/ref/delete_refs.go b/internal/gitaly/service/ref/delete_refs.go
index 4b0baa11e..6444c5743 100644
--- a/internal/gitaly/service/ref/delete_refs.go
+++ b/internal/gitaly/service/ref/delete_refs.go
@@ -3,6 +3,7 @@ package ref
 import (
 	"bufio"
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -21,6 +22,9 @@ func (s *server) DeleteRefs(ctx context.Context, in *gitalypb.DeleteRefsRequest)
 
 	updater, err := updateref.New(ctx, in.GetRepository())
 	if err != nil {
+		if errors.Is(err, git.ErrInvalidArg) {
+			return nil, helper.ErrInvalidArgument(err)
+		}
 		return nil, helper.ErrInternal(err)
 	}
 
diff --git a/internal/gitaly/service/ref/refs.go b/internal/gitaly/service/ref/refs.go
index 97ddd5796..e649869c2 100644
--- a/internal/gitaly/service/ref/refs.go
+++ b/internal/gitaly/service/ref/refs.go
@@ -13,6 +13,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/catfile"
 	gitlog "gitlab.com/gitlab-org/gitaly/internal/git/log"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/chunk"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/lines"
@@ -213,11 +214,11 @@ func _headReference(ctx context.Context, repo *gitalypb.Repository) ([]byte, err
 }
 
 // SetDefaultBranchRef overwrites the default branch ref for the repository
-func SetDefaultBranchRef(ctx context.Context, repo *gitalypb.Repository, ref string) error {
+func SetDefaultBranchRef(ctx context.Context, repo *gitalypb.Repository, ref string, cfg config.Cfg) error {
 	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
 		Name: "symbolic-ref",
 		Args: []string{"HEAD", ref},
-	})
+	}, git.WithRefTxHook(ctx, repo, cfg))
 	if err != nil {
 		return err
 	}
@@ -412,13 +413,16 @@ func parseTagLine(c *catfile.Batch, tagLine string) (*gitalypb.Tag, error) {
 }
 
 func findTag(ctx context.Context, repository *gitalypb.Repository, tagName []byte) (*gitalypb.Tag, error) {
-	tagCmd, err := git.SafeCmd(ctx, repository, nil, git.SubCmd{
-		Name: "tag",
-		Flags: []git.Option{
-			git.Flag{Name: "-l"}, git.ValueFlag{"--format", tagFormat},
+	tagCmd, err := git.SafeCmd(ctx, repository, nil,
+		git.SubCmd{
+			Name: "tag",
+			Flags: []git.Option{
+				git.Flag{Name: "-l"}, git.ValueFlag{"--format", tagFormat},
+			},
+			Args: []string{string(tagName)},
 		},
-		Args: []string{string(tagName)},
-	})
+		git.WithRefTxHook(ctx, repository, config.Config),
+	)
 	if err != nil {
 		return nil, fmt.Errorf("for-each-ref error: %v", err)
 	}
diff --git a/internal/gitaly/service/ref/refs_test.go b/internal/gitaly/service/ref/refs_test.go
index 79194728f..1c2f66431 100644
--- a/internal/gitaly/service/ref/refs_test.go
+++ b/internal/gitaly/service/ref/refs_test.go
@@ -17,6 +17,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git/catfile"
 	"gitlab.com/gitlab-org/gitaly/internal/git/log"
 	"gitlab.com/gitlab-org/gitaly/internal/git/updateref"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -328,7 +329,7 @@ func TestSetDefaultBranchRef(t *testing.T) {
 			testRepo, _, cleanupFn := testhelper.NewTestRepo(t)
 			defer cleanupFn()
 
-			err := SetDefaultBranchRef(ctx, testRepo, tc.ref)
+			err := SetDefaultBranchRef(ctx, testRepo, tc.ref, config.Config)
 			require.NoError(t, err)
 
 			newRef, err := DefaultBranchName(ctx, testRepo)
diff --git a/internal/gitaly/service/remote/fetch_internal_remote.go b/internal/gitaly/service/remote/fetch_internal_remote.go
index 5a1391427..ff644e64c 100644
--- a/internal/gitaly/service/remote/fetch_internal_remote.go
+++ b/internal/gitaly/service/remote/fetch_internal_remote.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/service/ref"
 	"gitlab.com/gitlab-org/gitaly/internal/gitalyssh"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
@@ -39,6 +40,7 @@ func (s *server) FetchInternalRemote(ctx context.Context, req *gitalypb.FetchInt
 			Args:  []string{gitalyssh.GitalyInternalURL, mirrorRefSpec},
 		},
 		git.WithStderr(stderr),
+		git.WithRefTxHook(ctx, req.Repository, config.Config),
 	)
 	if err != nil {
 		return nil, fmt.Errorf("create git fetch: %w", err)
@@ -60,7 +62,7 @@ func (s *server) FetchInternalRemote(ctx context.Context, req *gitalypb.FetchInt
 	}
 
 	if !bytes.Equal(defaultBranch, remoteDefaultBranch) {
-		if err := ref.SetDefaultBranchRef(ctx, req.Repository, string(remoteDefaultBranch)); err != nil {
+		if err := ref.SetDefaultBranchRef(ctx, req.Repository, string(remoteDefaultBranch), config.Config); err != nil {
 			return nil, status.Errorf(codes.Internal, "FetchInternalRemote: set default branch: %v", err)
 		}
 	}
diff --git a/internal/gitaly/service/remote/find_remote_root_ref.go b/internal/gitaly/service/remote/find_remote_root_ref.go
index 23dd0c03c..c3ef6a978 100644
--- a/internal/gitaly/service/remote/find_remote_root_ref.go
+++ b/internal/gitaly/service/remote/find_remote_root_ref.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -15,7 +16,9 @@ const headPrefix = "HEAD branch: "
 
 func findRemoteRootRef(ctx context.Context, repo *gitalypb.Repository, remote string) (string, error) {
 	cmd, err := git.SafeCmd(ctx, repo, nil,
-		git.SubCmd{Name: "remote", Flags: []git.Option{git.SubSubCmd{Name: "show"}}, Args: []string{remote}})
+		git.SubCmd{Name: "remote", Flags: []git.Option{git.SubSubCmd{Name: "show"}}, Args: []string{remote}},
+		git.WithRefTxHook(ctx, repo, config.Config),
+	)
 	if err != nil {
 		return "", err
 	}
diff --git a/internal/gitaly/service/remote/remotes.go b/internal/gitaly/service/remote/remotes.go
index e8e8897b8..074969d08 100644
--- a/internal/gitaly/service/remote/remotes.go
+++ b/internal/gitaly/service/remote/remotes.go
@@ -11,6 +11,7 @@ import (
 	"github.com/golang/protobuf/proto"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/remote"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/rubyserver"
 	"gitlab.com/gitlab-org/gitaly/internal/helper/chunk"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -54,7 +55,7 @@ func (s *server) RemoveRemote(ctx context.Context, req *gitalypb.RemoveRemoteReq
 		return nil, status.Errorf(codes.InvalidArgument, "RemoveRemote: %v", err)
 	}
 
-	hasRemote, err := remote.Exists(ctx, req.GetRepository(), req.Name)
+	hasRemote, err := remote.Exists(ctx, config.Config, req.GetRepository(), req.Name)
 	if err != nil {
 		return nil, err
 	}
@@ -62,7 +63,7 @@ func (s *server) RemoveRemote(ctx context.Context, req *gitalypb.RemoveRemoteReq
 		return &gitalypb.RemoveRemoteResponse{Result: false}, nil
 	}
 
-	if err := remote.Remove(ctx, req.GetRepository(), req.Name); err != nil {
+	if err := remote.Remove(ctx, config.Config, req.GetRepository(), req.Name); err != nil {
 		return nil, err
 	}
 
@@ -117,7 +118,9 @@ func (s *server) ListRemotes(req *gitalypb.ListRemotesRequest, stream gitalypb.R
 	repo := req.GetRepository()
 
 	ctx := stream.Context()
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{Name: "remote", Flags: []git.Option{git.Flag{Name: "-v"}}})
+	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{Name: "remote", Flags: []git.Option{git.Flag{Name: "-v"}}},
+		git.WithRefTxHook(ctx, repo, config.Config),
+	)
 	if err != nil {
 		return err
 	}
diff --git a/internal/gitaly/service/repository/archive.go b/internal/gitaly/service/repository/archive.go
index 61abdee28..bce628c89 100644
--- a/internal/gitaly/service/repository/archive.go
+++ b/internal/gitaly/service/repository/archive.go
@@ -81,7 +81,7 @@ func (s *server) GetArchive(in *gitalypb.GetArchiveRequest, stream gitalypb.Repo
 		return stream.Send(&gitalypb.GetArchiveResponse{Data: p})
 	})
 
-	gitlabConfig, err := json.Marshal(s.cfg)
+	gitlabConfig, err := json.Marshal(s.cfg.Gitlab)
 	if err != nil {
 		return err
 	}
diff --git a/internal/gitaly/service/repository/cleanup.go b/internal/gitaly/service/repository/cleanup.go
index 00b7d49c8..752b89c8e 100644
--- a/internal/gitaly/service/repository/cleanup.go
+++ b/internal/gitaly/service/repository/cleanup.go
@@ -39,11 +39,11 @@ func (s *server) cleanupRepo(ctx context.Context, repo *gitalypb.Repository) err
 	}
 
 	worktreeThreshold := time.Now().Add(-6 * time.Hour)
-	if err := cleanStaleWorktrees(ctx, repo, repoPath, worktreeThreshold); err != nil {
+	if err := s.cleanStaleWorktrees(ctx, repo, repoPath, worktreeThreshold); err != nil {
 		return status.Errorf(codes.Internal, "Cleanup: cleanStaleWorktrees: %v", err)
 	}
 
-	if err := cleanDisconnectedWorktrees(ctx, repo); err != nil {
+	if err := s.cleanDisconnectedWorktrees(ctx, repo); err != nil {
 		return status.Errorf(codes.Internal, "Cleanup: cleanDisconnectedWorktrees: %v", err)
 	}
 
@@ -104,7 +104,7 @@ func cleanPackedRefsLock(repoPath string, threshold time.Time) error {
 	return nil
 }
 
-func cleanStaleWorktrees(ctx context.Context, repo *gitalypb.Repository, repoPath string, threshold time.Time) error {
+func (s *server) cleanStaleWorktrees(ctx context.Context, repo *gitalypb.Repository, repoPath string, threshold time.Time) error {
 	worktreePath := filepath.Join(repoPath, worktreePrefix)
 
 	dirInfo, err := os.Stat(worktreePath)
@@ -126,10 +126,13 @@ func cleanStaleWorktrees(ctx context.Context, repo *gitalypb.Repository, repoPat
 		}
 
 		if info.ModTime().Before(threshold) {
-			cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
-				Name:  "worktree",
-				Flags: []git.Option{git.SubSubCmd{"remove"}, git.Flag{Name: "--force"}, git.SubSubCmd{info.Name()}},
-			})
+			cmd, err := git.SafeCmd(ctx, repo, nil,
+				git.SubCmd{
+					Name:  "worktree",
+					Flags: []git.Option{git.SubSubCmd{"remove"}, git.Flag{Name: "--force"}, git.SubSubCmd{info.Name()}},
+				},
+				git.WithRefTxHook(ctx, repo, s.cfg),
+			)
 			if err != nil {
 				return err
 			}
@@ -143,11 +146,14 @@ func cleanStaleWorktrees(ctx context.Context, repo *gitalypb.Repository, repoPat
 	return nil
 }
 
-func cleanDisconnectedWorktrees(ctx context.Context, repo *gitalypb.Repository) error {
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
-		Name:  "worktree",
-		Flags: []git.Option{git.SubSubCmd{"prune"}},
-	})
+func (s *server) cleanDisconnectedWorktrees(ctx context.Context, repo *gitalypb.Repository) error {
+	cmd, err := git.SafeCmd(ctx, repo, nil,
+		git.SubCmd{
+			Name:  "worktree",
+			Flags: []git.Option{git.SubSubCmd{"prune"}},
+		},
+		git.WithRefTxHook(ctx, repo, s.cfg),
+	)
 	if err != nil {
 		return err
 	}
diff --git a/internal/gitaly/service/repository/clone_from_pool.go b/internal/gitaly/service/repository/clone_from_pool.go
index 6f07fb0f2..b916f7369 100644
--- a/internal/gitaly/service/repository/clone_from_pool.go
+++ b/internal/gitaly/service/repository/clone_from_pool.go
@@ -7,6 +7,7 @@ import (
 	"os"
 
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
@@ -32,7 +33,7 @@ func (s *server) CloneFromPool(ctx context.Context, req *gitalypb.CloneFromPoolR
 		return nil, helper.ErrInternalf("fetch http remote: %v", err)
 	}
 
-	objectPool, err := objectpool.FromProto(s.locator, req.GetPool())
+	objectPool, err := objectpool.FromProto(s.cfg, config.NewLocator(s.cfg), req.GetPool())
 	if err != nil {
 		return nil, helper.ErrInternalf("get object pool from request: %v", err)
 	}
@@ -54,7 +55,7 @@ func (s *server) validateCloneFromPoolRequestRepositoryState(req *gitalypb.Clone
 		return errors.New("target reopsitory already exists")
 	}
 
-	objectPool, err := objectpool.FromProto(s.locator, req.GetPool())
+	objectPool, err := objectpool.FromProto(s.cfg, config.NewLocator(s.cfg), req.GetPool())
 	if err != nil {
 		return fmt.Errorf("getting object pool from repository: %v", err)
 	}
diff --git a/internal/gitaly/service/repository/clone_from_pool_internal.go b/internal/gitaly/service/repository/clone_from_pool_internal.go
index 6e3447cdf..7034568b3 100644
--- a/internal/gitaly/service/repository/clone_from_pool_internal.go
+++ b/internal/gitaly/service/repository/clone_from_pool_internal.go
@@ -9,6 +9,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/objectpool"
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
@@ -46,7 +47,7 @@ func (s *server) CloneFromPoolInternal(ctx context.Context, req *gitalypb.CloneF
 		return nil, helper.ErrInternalf("fetch internal remote failed")
 	}
 
-	objectPool, err := objectpool.FromProto(s.locator, req.GetPool())
+	objectPool, err := objectpool.FromProto(s.cfg, config.NewLocator(s.cfg), req.GetPool())
 	if err != nil {
 		return nil, helper.ErrInternalf("get object pool from request: %v", err)
 	}
@@ -68,7 +69,7 @@ func (s *server) validateCloneFromPoolInternalRequestRepositoryState(req *gitaly
 		return errors.New("target reopsitory already exists")
 	}
 
-	objectPool, err := objectpool.FromProto(s.locator, req.GetPool())
+	objectPool, err := objectpool.FromProto(s.cfg, config.NewLocator(s.cfg), req.GetPool())
 	if err != nil {
 		return fmt.Errorf("getting object pool from repository: %v", err)
 	}
@@ -119,11 +120,19 @@ func (s *server) cloneFromPool(ctx context.Context, objectPoolRepo *gitalypb.Obj
 		return fmt.Errorf("could not get object pool path: %v", err)
 	}
 
-	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{}, nil, nil, git.SubCmd{
-		Name:        "clone",
-		Flags:       []git.Option{git.Flag{Name: "--bare"}, git.Flag{Name: "--shared"}},
-		PostSepArgs: []string{objectPoolPath, repositoryPath},
-	})
+	pbRepo, ok := repo.(*gitalypb.Repository)
+	if !ok {
+		return fmt.Errorf("expected *gitlaypb.Repository but got %T", repo)
+	}
+
+	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{}, nil, nil,
+		git.SubCmd{
+			Name:        "clone",
+			Flags:       []git.Option{git.Flag{Name: "--bare"}, git.Flag{Name: "--shared"}},
+			PostSepArgs: []string{objectPoolPath, repositoryPath},
+		},
+		git.WithRefTxHook(ctx, pbRepo, s.cfg),
+	)
 	if err != nil {
 		return fmt.Errorf("clone with object pool start: %v", err)
 	}
diff --git a/internal/gitaly/service/repository/clone_from_pool_internal_test.go b/internal/gitaly/service/repository/clone_from_pool_internal_test.go
index 719f8b6b2..16f47e6e1 100644
--- a/internal/gitaly/service/repository/clone_from_pool_internal_test.go
+++ b/internal/gitaly/service/repository/clone_from_pool_internal_test.go
@@ -22,7 +22,7 @@ func NewTestObjectPool(t *testing.T) (*objectpool.ObjectPool, *gitalypb.Reposito
 	relativePath := testhelper.NewTestObjectPoolName(t)
 	repo := testhelper.CreateRepo(t, storagePath, relativePath)
 
-	pool, err := objectpool.NewObjectPool(config.NewLocator(config.Config), repo.GetStorageName(), relativePath)
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), repo.GetStorageName(), relativePath)
 	require.NoError(t, err)
 
 	return pool, repo
diff --git a/internal/gitaly/service/repository/commit_graph.go b/internal/gitaly/service/repository/commit_graph.go
index 845bf3785..5b2a07156 100644
--- a/internal/gitaly/service/repository/commit_graph.go
+++ b/internal/gitaly/service/repository/commit_graph.go
@@ -14,15 +14,15 @@ const (
 )
 
 // WriteCommitGraph write or update commit-graph file in a repository
-func (*server) WriteCommitGraph(ctx context.Context, in *gitalypb.WriteCommitGraphRequest) (*gitalypb.WriteCommitGraphResponse, error) {
-	if err := writeCommitGraph(ctx, in); err != nil {
+func (s *server) WriteCommitGraph(ctx context.Context, in *gitalypb.WriteCommitGraphRequest) (*gitalypb.WriteCommitGraphResponse, error) {
+	if err := s.writeCommitGraph(ctx, in); err != nil {
 		return nil, helper.ErrInternal(fmt.Errorf("WriteCommitGraph: gitCommand: %v", err))
 	}
 
 	return &gitalypb.WriteCommitGraphResponse{}, nil
 }
 
-func writeCommitGraph(ctx context.Context, in *gitalypb.WriteCommitGraphRequest) error {
+func (s *server) writeCommitGraph(ctx context.Context, in *gitalypb.WriteCommitGraphRequest) error {
 	cmd, err := git.SafeCmd(ctx, in.GetRepository(), nil,
 		git.SubCmd{
 			Name: "commit-graph",
@@ -31,6 +31,7 @@ func writeCommitGraph(ctx context.Context, in *gitalypb.WriteCommitGraphRequest)
 				git.Flag{Name: "--reachable"},
 			},
 		},
+		git.WithRefTxHook(ctx, in.Repository, s.cfg),
 	)
 	if err != nil {
 		return err
diff --git a/internal/gitaly/service/repository/create_from_url.go b/internal/gitaly/service/repository/create_from_url.go
index a40488d10..b430b9565 100644
--- a/internal/gitaly/service/repository/create_from_url.go
+++ b/internal/gitaly/service/repository/create_from_url.go
@@ -17,7 +17,7 @@ import (
 	"google.golang.org/grpc/status"
 )
 
-func cloneFromURLCommand(ctx context.Context, repoURL, repositoryFullPath string, stderr io.Writer) (*command.Command, error) {
+func (s *server) cloneFromURLCommand(ctx context.Context, repo *gitalypb.Repository, repoURL, repositoryFullPath string, stderr io.Writer) (*command.Command, error) {
 	u, err := url.Parse(repoURL)
 	if err != nil {
 		return nil, helper.ErrInternal(err)
@@ -47,11 +47,14 @@ func cloneFromURLCommand(ctx context.Context, repoURL, repositoryFullPath string
 		globalFlags = append(globalFlags, git.ValueFlag{Name: "-c", Value: fmt.Sprintf("http.extraHeader=%s", authHeader)})
 	}
 
-	return git.SafeBareCmd(ctx, git.CmdStream{Err: stderr}, nil, globalFlags, git.SubCmd{
-		Name:        "clone",
-		Flags:       cloneFlags,
-		PostSepArgs: []string{u.String(), repositoryFullPath},
-	})
+	return git.SafeBareCmd(ctx, git.CmdStream{Err: stderr}, nil, globalFlags,
+		git.SubCmd{
+			Name:        "clone",
+			Flags:       cloneFlags,
+			PostSepArgs: []string{u.String(), repositoryFullPath},
+		},
+		git.WithRefTxHook(ctx, repo, s.cfg),
+	)
 }
 
 func (s *server) CreateRepositoryFromURL(ctx context.Context, req *gitalypb.CreateRepositoryFromURLRequest) (*gitalypb.CreateRepositoryFromURLResponse, error) {
@@ -71,7 +74,7 @@ func (s *server) CreateRepositoryFromURL(ctx context.Context, req *gitalypb.Crea
 	}
 
 	stderr := bytes.Buffer{}
-	cmd, err := cloneFromURLCommand(ctx, req.GetUrl(), repositoryFullPath, &stderr)
+	cmd, err := s.cloneFromURLCommand(ctx, repository, req.GetUrl(), repositoryFullPath, &stderr)
 	if err != nil {
 		return nil, helper.ErrInternal(err)
 	}
@@ -86,7 +89,7 @@ func (s *server) CreateRepositoryFromURL(ctx context.Context, req *gitalypb.Crea
 		return nil, status.Errorf(codes.Internal, "CreateRepositoryFromURL: create hooks failed: %v", err)
 	}
 
-	if err := removeOriginInRepo(ctx, repository); err != nil {
+	if err := s.removeOriginInRepo(ctx, repository); err != nil {
 		return nil, status.Errorf(codes.Internal, "CreateRepositoryFromURL: %v", err)
 	}
 
diff --git a/internal/gitaly/service/repository/create_from_url_test.go b/internal/gitaly/service/repository/create_from_url_test.go
index 0807f47a5..636d35e4f 100644
--- a/internal/gitaly/service/repository/create_from_url_test.go
+++ b/internal/gitaly/service/repository/create_from_url_test.go
@@ -72,7 +72,8 @@ func TestCloneRepositoryFromUrlCommand(t *testing.T) {
 	repositoryFullPath := "full/path/to/repository"
 	url := fmt.Sprintf("https://%s@www.example.com/secretrepo.git", userInfo)
 
-	cmd, err := cloneFromURLCommand(ctx, url, repositoryFullPath, nil)
+	s := &server{cfg: config.Config}
+	cmd, err := s.cloneFromURLCommand(ctx, &gitalypb.Repository{}, url, repositoryFullPath, nil)
 	require.NoError(t, err)
 
 	expectedScrubbedURL := "https://www.example.com/secretrepo.git"
diff --git a/internal/gitaly/service/repository/fetch.go b/internal/gitaly/service/repository/fetch.go
index 4990aac93..9bdc059df 100644
--- a/internal/gitaly/service/repository/fetch.go
+++ b/internal/gitaly/service/repository/fetch.go
@@ -52,6 +52,7 @@ func (s *server) FetchSourceBranch(ctx context.Context, req *gitalypb.FetchSourc
 			Flags: []git.Option{git.Flag{Name: "--prune"}},
 			Args:  []string{remote, refspec},
 		},
+		git.WithRefTxHook(ctx, req.Repository, s.cfg),
 	)
 	if err != nil {
 		return nil, err
diff --git a/internal/gitaly/service/repository/fork.go b/internal/gitaly/service/repository/fork.go
index 7d46acc66..802d5a5c5 100644
--- a/internal/gitaly/service/repository/fork.go
+++ b/internal/gitaly/service/repository/fork.go
@@ -41,14 +41,20 @@ func (s *server) CreateFork(ctx context.Context, req *gitalypb.CreateForkRequest
 		return nil, err
 	}
 
-	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{}, env, nil, git.SubCmd{
-		Name:  "clone",
-		Flags: []git.Option{git.Flag{Name: "--bare"}, git.Flag{Name: "--no-local"}},
-		PostSepArgs: []string{
-			fmt.Sprintf("%s:%s", gitalyssh.GitalyInternalURL, sourceRepository.RelativePath),
-			targetRepositoryFullPath,
+	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{}, env, nil,
+		git.SubCmd{
+			Name: "clone",
+			Flags: []git.Option{
+				git.Flag{Name: "--bare"},
+				git.Flag{Name: "--no-local"},
+			},
+			PostSepArgs: []string{
+				fmt.Sprintf("%s:%s", gitalyssh.GitalyInternalURL, sourceRepository.RelativePath),
+				targetRepositoryFullPath,
+			},
 		},
-	})
+		git.WithRefTxHook(ctx, req.Repository, s.cfg),
+	)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, "CreateFork: clone cmd start: %v", err)
 	}
@@ -56,7 +62,7 @@ func (s *server) CreateFork(ctx context.Context, req *gitalypb.CreateForkRequest
 		return nil, status.Errorf(codes.Internal, "CreateFork: clone cmd wait: %v", err)
 	}
 
-	if err := removeOriginInRepo(ctx, targetRepository); err != nil {
+	if err := s.removeOriginInRepo(ctx, targetRepository); err != nil {
 		return nil, status.Errorf(codes.Internal, "CreateFork: %v", err)
 	}
 
diff --git a/internal/gitaly/service/repository/gc.go b/internal/gitaly/service/repository/gc.go
index 78980e9a5..d95b0952c 100644
--- a/internal/gitaly/service/repository/gc.go
+++ b/internal/gitaly/service/repository/gc.go
@@ -39,7 +39,7 @@ func (s *server) GarbageCollect(ctx context.Context, in *gitalypb.GarbageCollect
 		return nil, err
 	}
 
-	if err := gc(ctx, in); err != nil {
+	if err := s.gc(ctx, in); err != nil {
 		return nil, err
 	}
 
@@ -47,7 +47,7 @@ func (s *server) GarbageCollect(ctx context.Context, in *gitalypb.GarbageCollect
 		return nil, err
 	}
 
-	if err := writeCommitGraph(ctx, &gitalypb.WriteCommitGraphRequest{Repository: repo}); err != nil {
+	if err := s.writeCommitGraph(ctx, &gitalypb.WriteCommitGraphRequest{Repository: repo}); err != nil {
 		return nil, err
 	}
 
@@ -62,7 +62,7 @@ func (s *server) GarbageCollect(ctx context.Context, in *gitalypb.GarbageCollect
 	return &gitalypb.GarbageCollectResponse{}, nil
 }
 
-func gc(ctx context.Context, in *gitalypb.GarbageCollectRequest) error {
+func (s *server) gc(ctx context.Context, in *gitalypb.GarbageCollectRequest) error {
 	args := repackConfig(ctx, in.CreateBitmap)
 
 	var flags []git.Option
@@ -72,6 +72,7 @@ func gc(ctx context.Context, in *gitalypb.GarbageCollectRequest) error {
 
 	cmd, err := git.SafeCmd(ctx, in.GetRepository(), args,
 		git.SubCmd{Name: "gc", Flags: flags},
+		git.WithRefTxHook(ctx, in.GetRepository(), s.cfg),
 	)
 
 	if err != nil {
@@ -148,7 +149,7 @@ func (s *server) cleanupKeepArounds(ctx context.Context, repo *gitalypb.Reposito
 			continue
 		}
 
-		if err := fixRef(ctx, repo, batch, path, refName, info.Name()); err != nil {
+		if err := s.fixRef(ctx, repo, batch, path, refName, info.Name()); err != nil {
 			return err
 		}
 	}
@@ -165,7 +166,7 @@ func checkRef(batch *catfile.Batch, refName string, info os.FileInfo) error {
 	return err
 }
 
-func fixRef(ctx context.Context, repo *gitalypb.Repository, batch *catfile.Batch, refPath string, name string, sha string) error {
+func (s *server) fixRef(ctx context.Context, repo *gitalypb.Repository, batch *catfile.Batch, refPath string, name string, sha string) error {
 	// So the ref is broken, let's get rid of it
 	if err := os.RemoveAll(refPath); err != nil {
 		return err
@@ -177,10 +178,13 @@ func fixRef(ctx context.Context, repo *gitalypb.Repository, batch *catfile.Batch
 	}
 
 	// The name is a valid sha, recreate the ref
-	cmd, err := git.SafeCmd(ctx, repo, nil, git.SubCmd{
-		Name: "update-ref",
-		Args: []string{name, sha},
-	})
+	cmd, err := git.SafeCmd(ctx, repo, nil,
+		git.SubCmd{
+			Name: "update-ref",
+			Args: []string{name, sha},
+		},
+		git.WithRefTxHook(ctx, repo, s.cfg),
+	)
 	if err != nil {
 		return err
 	}
diff --git a/internal/gitaly/service/repository/merge_base.go b/internal/gitaly/service/repository/merge_base.go
index e663085a0..f2019deed 100644
--- a/internal/gitaly/service/repository/merge_base.go
+++ b/internal/gitaly/service/repository/merge_base.go
@@ -21,10 +21,12 @@ func (s *server) FindMergeBase(ctx context.Context, req *gitalypb.FindMergeBaseR
 		return nil, status.Errorf(codes.InvalidArgument, "FindMergeBase: at least 2 revisions are required")
 	}
 
-	cmd, err := git.SafeCmd(ctx, req.GetRepository(), nil, git.SubCmd{
-		Name: "merge-base",
-		Args: revisions,
-	})
+	cmd, err := git.SafeCmd(ctx, req.GetRepository(), nil,
+		git.SubCmd{
+			Name: "merge-base",
+			Args: revisions,
+		},
+	)
 	if err != nil {
 		if _, ok := status.FromError(err); ok {
 			return nil, err
diff --git a/internal/gitaly/service/repository/remove.go b/internal/gitaly/service/repository/remove.go
index 3a89a1e52..ff7058d91 100644
--- a/internal/gitaly/service/repository/remove.go
+++ b/internal/gitaly/service/repository/remove.go
@@ -5,7 +5,6 @@ import (
 	"os"
 	"path/filepath"
 
-	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/internal/tempdir"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
@@ -17,7 +16,7 @@ func (s *server) RemoveRepository(ctx context.Context, in *gitalypb.RemoveReposi
 		return nil, helper.ErrInternal(err)
 	}
 
-	storage, ok := config.Config.Storage(in.GetRepository().GetStorageName())
+	storage, ok := s.cfg.Storage(in.GetRepository().GetStorageName())
 	if !ok {
 		return nil, helper.ErrInvalidArgumentf("storage %v not found", in.GetRepository().GetStorageName())
 	}
diff --git a/internal/gitaly/service/repository/server.go b/internal/gitaly/service/repository/server.go
index f82abaa05..353467b37 100644
--- a/internal/gitaly/service/repository/server.go
+++ b/internal/gitaly/service/repository/server.go
@@ -13,7 +13,7 @@ type server struct {
 	conns                *client.Pool
 	internalGitalySocket string
 	locator              storage.Locator
-	cfg                  config.Gitlab
+	cfg                  config.Cfg
 	binDir               string
 	loggingCfg           config.Logging
 }
@@ -25,7 +25,7 @@ func NewServer(cfg config.Cfg, rs *rubyserver.Server, locator storage.Locator, i
 		locator:              locator,
 		conns:                client.NewPool(),
 		internalGitalySocket: internalGitalySocket,
-		cfg:                  cfg.Gitlab,
+		cfg:                  cfg,
 		binDir:               cfg.BinDir,
 		loggingCfg:           cfg.Logging,
 	}
diff --git a/internal/gitaly/service/repository/util.go b/internal/gitaly/service/repository/util.go
index 16839fa44..c0662ac56 100644
--- a/internal/gitaly/service/repository/util.go
+++ b/internal/gitaly/service/repository/util.go
@@ -8,8 +8,8 @@ import (
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 )
 
-func removeOriginInRepo(ctx context.Context, repository *gitalypb.Repository) error {
-	cmd, err := git.SafeCmd(ctx, repository, nil, git.SubCmd{Name: "remote", Args: []string{"remove", "origin"}})
+func (s *server) removeOriginInRepo(ctx context.Context, repository *gitalypb.Repository) error {
+	cmd, err := git.SafeCmd(ctx, repository, nil, git.SubCmd{Name: "remote", Args: []string{"remove", "origin"}}, git.WithRefTxHook(ctx, repository, s.cfg))
 
 	if err != nil {
 		return fmt.Errorf("remote cmd start: %v", err)
diff --git a/internal/gitaly/service/repository/write_ref.go b/internal/gitaly/service/repository/write_ref.go
index bbaf239cb..51a38962a 100644
--- a/internal/gitaly/service/repository/write_ref.go
+++ b/internal/gitaly/service/repository/write_ref.go
@@ -15,22 +15,28 @@ func (s *server) WriteRef(ctx context.Context, req *gitalypb.WriteRefRequest) (*
 	if err := validateWriteRefRequest(req); err != nil {
 		return nil, helper.ErrInvalidArgument(err)
 	}
-	if err := writeRef(ctx, req); err != nil {
+	if err := s.writeRef(ctx, req); err != nil {
 		return nil, helper.ErrInternal(err)
 	}
 
 	return &gitalypb.WriteRefResponse{}, nil
 }
 
-func writeRef(ctx context.Context, req *gitalypb.WriteRefRequest) error {
+func (s *server) writeRef(ctx context.Context, req *gitalypb.WriteRefRequest) error {
 	if string(req.Ref) == "HEAD" {
-		return updateSymbolicRef(ctx, req)
+		return s.updateSymbolicRef(ctx, req)
 	}
 	return updateRef(ctx, req)
 }
 
-func updateSymbolicRef(ctx context.Context, req *gitalypb.WriteRefRequest) error {
-	cmd, err := git.SafeCmd(ctx, req.GetRepository(), nil, git.SubCmd{Name: "symbolic-ref", Args: []string{string(req.GetRef()), string(req.GetRevision())}})
+func (s *server) updateSymbolicRef(ctx context.Context, req *gitalypb.WriteRefRequest) error {
+	cmd, err := git.SafeCmd(ctx, req.GetRepository(), nil,
+		git.SubCmd{
+			Name: "symbolic-ref",
+			Args: []string{string(req.GetRef()), string(req.GetRevision())},
+		},
+		git.WithRefTxHook(ctx, req.GetRepository(), s.cfg),
+	)
 	if err != nil {
 		return fmt.Errorf("error when creating symbolic-ref command: %v", err)
 	}
diff --git a/internal/gitaly/service/smarthttp/inforefs.go b/internal/gitaly/service/smarthttp/inforefs.go
index dd4b78a24..71034daaa 100644
--- a/internal/gitaly/service/smarthttp/inforefs.go
+++ b/internal/gitaly/service/smarthttp/inforefs.go
@@ -9,6 +9,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
 	"gitlab.com/gitlab-org/gitaly/internal/git/pktline"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/gitaly/streamio"
 	"google.golang.org/grpc/codes"
@@ -48,8 +49,10 @@ func (s *server) handleInfoRefs(ctx context.Context, service string, req *gitaly
 	}
 
 	var globalOpts []git.Option
+	cmdOpts := []git.CmdOpt{git.WithGitProtocol(ctx, req)}
 	if service == "receive-pack" {
 		globalOpts = append(globalOpts, git.ReceivePackConfig()...)
+		cmdOpts = append(cmdOpts, git.WithRefTxHook(ctx, req.Repository, config.Config))
 	}
 
 	if service == "upload-pack" {
@@ -64,7 +67,7 @@ func (s *server) handleInfoRefs(ctx context.Context, service string, req *gitaly
 		Name:  service,
 		Flags: []git.Option{git.Flag{Name: "--stateless-rpc"}, git.Flag{Name: "--advertise-refs"}},
 		Args:  []string{repoPath},
-	}, git.WithGitProtocol(ctx, req))
+	}, cmdOpts...)
 
 	if err != nil {
 		if _, ok := status.FromError(err); ok {
diff --git a/internal/gitaly/service/smarthttp/inforefs_test.go b/internal/gitaly/service/smarthttp/inforefs_test.go
index 692f7f132..a9ff321bf 100644
--- a/internal/gitaly/service/smarthttp/inforefs_test.go
+++ b/internal/gitaly/service/smarthttp/inforefs_test.go
@@ -193,7 +193,7 @@ func TestObjectPoolRefAdvertisementHiding(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	pool, err := objectpool.NewObjectPool(config.NewLocator(config.Config), repo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), repo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	require.NoError(t, pool.Create(ctx, repo))
diff --git a/internal/gitaly/service/smarthttp/receive_pack.go b/internal/gitaly/service/smarthttp/receive_pack.go
index 31e0128ba..f1187a2b3 100644
--- a/internal/gitaly/service/smarthttp/receive_pack.go
+++ b/internal/gitaly/service/smarthttp/receive_pack.go
@@ -4,6 +4,7 @@ import (
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
 	log "github.com/sirupsen/logrus"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/gitaly/streamio"
@@ -47,11 +48,16 @@ func (s *server) PostReceivePack(stream gitalypb.SmartHTTPService_PostReceivePac
 		globalOpts = append(globalOpts, git.ValueFlag{"-c", o})
 	}
 
-	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{In: stdin, Out: stdout}, nil, globalOpts, git.SubCmd{
-		Name:  "receive-pack",
-		Flags: []git.Option{git.Flag{Name: "--stateless-rpc"}},
-		Args:  []string{repoPath},
-	}, git.WithReceivePackHooks(ctx, req, "http"), git.WithGitProtocol(ctx, req))
+	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{In: stdin, Out: stdout}, nil, globalOpts,
+		git.SubCmd{
+			Name:  "receive-pack",
+			Flags: []git.Option{git.Flag{Name: "--stateless-rpc"}},
+			Args:  []string{repoPath},
+		},
+		git.WithReceivePackHooks(ctx, req, "http"),
+		git.WithGitProtocol(ctx, req),
+		git.WithRefTxHook(ctx, req.Repository, config.Config),
+	)
 
 	if err != nil {
 		return status.Errorf(codes.Unavailable, "PostReceivePack: %v", err)
diff --git a/internal/gitaly/service/ssh/receive_pack.go b/internal/gitaly/service/ssh/receive_pack.go
index 4d62adaf0..d949eeb87 100644
--- a/internal/gitaly/service/ssh/receive_pack.go
+++ b/internal/gitaly/service/ssh/receive_pack.go
@@ -9,6 +9,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"gitlab.com/gitlab-org/gitaly/internal/command"
 	"gitlab.com/gitlab-org/gitaly/internal/git"
+	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/helper"
 	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/gitaly/streamio"
@@ -65,10 +66,15 @@ func (s *server) sshReceivePack(stream gitalypb.SSHService_SSHReceivePackServer,
 		globalOpts = append(globalOpts, git.ValueFlag{"-c", o})
 	}
 
-	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{In: stdin, Out: stdout, Err: stderr}, nil, globalOpts, git.SubCmd{
-		Name: "receive-pack",
-		Args: []string{repoPath},
-	}, git.WithReceivePackHooks(ctx, req, "ssh"), git.WithGitProtocol(ctx, req))
+	cmd, err := git.SafeBareCmd(ctx, git.CmdStream{In: stdin, Out: stdout, Err: stderr}, nil, globalOpts,
+		git.SubCmd{
+			Name: "receive-pack",
+			Args: []string{repoPath},
+		},
+		git.WithReceivePackHooks(ctx, req, "ssh"),
+		git.WithGitProtocol(ctx, req),
+		git.WithRefTxHook(ctx, req.Repository, config.Config),
+	)
 
 	if err != nil {
 		return fmt.Errorf("start cmd: %v", err)
diff --git a/internal/gitaly/service/ssh/receive_pack_test.go b/internal/gitaly/service/ssh/receive_pack_test.go
index 3dc204975..9647e74a4 100644
--- a/internal/gitaly/service/ssh/receive_pack_test.go
+++ b/internal/gitaly/service/ssh/receive_pack_test.go
@@ -177,7 +177,7 @@ func TestObjectPoolRefAdvertisementHidingSSH(t *testing.T) {
 	repo, _, cleanupFn := testhelper.NewTestRepo(t)
 	defer cleanupFn()
 
-	pool, err := objectpool.NewObjectPool(config.NewLocator(config.Config), repo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
+	pool, err := objectpool.NewObjectPool(config.Config, config.NewLocator(config.Config), repo.GetStorageName(), testhelper.NewTestObjectPoolName(t))
 	require.NoError(t, err)
 
 	require.NoError(t, pool.Create(ctx, repo))
diff --git a/internal/helper/repo.go b/internal/helper/repo.go
index 5f8b502bc..afa7a689f 100644
--- a/internal/helper/repo.go
+++ b/internal/helper/repo.go
@@ -7,6 +7,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/internal/git/repository"
 	"gitlab.com/gitlab-org/gitaly/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/internal/storage"
+	"gitlab.com/gitlab-org/gitaly/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
@@ -74,3 +75,14 @@ func GetStorageByName(storageName string) (string, error) {
 
 	return storagePath, nil
 }
+
+// ProtoRepoFromRepo allows object pools and repository abstractions to be used
+// in places that require a concrete type
+func ProtoRepoFromRepo(repo repository.GitRepo) *gitalypb.Repository {
+	return &gitalypb.Repository{
+		StorageName:                   repo.GetStorageName(),
+		GitAlternateObjectDirectories: repo.GetGitAlternateObjectDirectories(),
+		GitObjectDirectory:            repo.GetGitObjectDirectory(),
+		RelativePath:                  repo.GetRelativePath(),
+	}
+}
diff --git a/internal/praefect/replicator_test.go b/internal/praefect/replicator_test.go
index 6eb2132ca..82bfb1697 100644
--- a/internal/praefect/replicator_test.go
+++ b/internal/praefect/replicator_test.go
@@ -96,7 +96,7 @@ func TestReplMgr_ProcessBacklog(t *testing.T) {
 
 	// create object pool on the source
 	objectPoolPath := testhelper.NewTestObjectPoolName(t)
-	pool, err := objectpool.NewObjectPool(gitaly_config.NewLocator(gitaly_config.Config), testRepo.GetStorageName(), objectPoolPath)
+	pool, err := objectpool.NewObjectPool(gitaly_config.Config, gitaly_config.NewLocator(gitaly_config.Config), testRepo.GetStorageName(), objectPoolPath)
 	require.NoError(t, err)
 
 	poolCtx, cancel := testhelper.Context()
diff --git a/internal/testhelper/testhelper.go b/internal/testhelper/testhelper.go
index 87c185baf..41b034aeb 100644
--- a/internal/testhelper/testhelper.go
+++ b/internal/testhelper/testhelper.go
@@ -660,7 +660,7 @@ func ListenGitalySSHCalls(t *testing.T, conf config.Cfg) (config.Cfg, func() []G
 					return nil
 				}
 
-				idx, err := strconv.Atoi(strings.TrimPrefix(filename, prefix))
+				idx, err := strconv.Atoi(strings.TrimSpace(strings.TrimPrefix(filename, prefix)))
 				if err != nil {
 					return err
 				}