diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index dd42d5632a..d0da46787c 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -157,7 +157,16 @@ pub enum ObjectType {
     WorkspaceDependencies,
 }
 
-pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28231/sync-script-to-git-repo-windmill";
+// hub/28231 ("thin" script that delegates commit/push to the CLI's `sync
+// git-deploy`) breaks GPG-signed deploys: by the time the CLI runs `git
+// commit`, gpg-agent's passphrase cache from the script's pre-warm dummy sign
+// is no longer valid for the spawned git process, so `git commit` fails with
+// `gpg failed to sign the data` (WIN-1974). hub/28230 keeps the GPG setup AND
+// the commit in the same in-script flow (originally 28217's logic, rebuilt
+// with windmill-cli@1.703.3) and is the last known-good default. A forward
+// fix (CLI-side gpg.program wrapper that doesn't depend on agent state, then a
+// new thin script that opts into it) will re-bump this past 28231.
+pub const LATEST_GIT_SYNC_SCRIPT_PATH: &str = "hub/28230/sync-script-to-git-repo-windmill";
 
 /// Prefix used to identify fork workspaces. A workspace whose id starts with this string is a
 /// fork of another workspace.