diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 56ef0b00b6..608773d2df 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-b705a9be1c4294851f534bab7a7cdfa75303d715
\ No newline at end of file
+5d9cd2b60b286840d1647103f89cf7953b8b2065
\ No newline at end of file
diff --git a/frontend/src/lib/components/git_sync/managedCredential.ts b/frontend/src/lib/components/git_sync/managedCredential.ts
index 3eccc8767a..39e3c2fc50 100644
--- a/frontend/src/lib/components/git_sync/managedCredential.ts
+++ b/frontend/src/lib/components/git_sync/managedCredential.ts
@@ -17,9 +17,16 @@ function urlCarriesCredential(url: string | undefined): boolean {
  * have the UI promise renewal for a token nothing renews. That happens whenever
  * someone puts a token back in the URL without clearing the marker, which is why
  * this is checked rather than trusting the marker alone.
+ *
+ * A `$var:` URL is treated the same way. Only the server can resolve it, so
+ * whether it carries a token is unknowable here, and claiming a managed
+ * credential would be a guess: the picker always writes a plain URL, so nothing
+ * this marker legitimately describes reaches us as a variable reference.
  */
 export function managedCredentialHost(value: GitRepositoryValue): string | undefined {
 	const host = value?.managed_credential
 	if (!host || host === 'none') return undefined
-	return urlCarriesCredential(value?.url) ? undefined : host
+	const url = value?.url
+	if (url?.startsWith('$var:')) return undefined
+	return urlCarriesCredential(url) ? undefined : host
 }