diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index efc5187476..fda20289f5 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-8bf73f803158bcbf7b8d55a36f4a1ebfcc1bbcd9
+183f78b3ee193d6b5e55fd453c570f94a12c8b13
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index f20fce538d..5ab233e994 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -3523,7 +3523,8 @@ async fn edit_git_sync_config(
             tracing::warn!("git auto-pull: webhook field persist error: {}", e);
         }
         for (path, hook_id) in removed_webhooks {
-            if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url(&db, &w_id, &path).await
+            if let Ok(url) =
+                windmill_common::git_sync_ee::resolve_repo_url_interpolated(&db, &w_id, &path).await
             {
                 let _ =
                     windmill_common::git_sync_ee::delete_repo_webhook(&db, &w_id, &url, hook_id)
@@ -3882,7 +3883,7 @@ async fn delete_git_sync_repository(
     // Removal is durable now — best-effort delete the GitHub webhook.
     #[cfg(all(feature = "enterprise", feature = "private"))]
     if let Some(hook_id) = webhook_to_delete {
-        if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url(
+        if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url_interpolated(
             &db,
             &w_id,
             &request.git_repo_resource_path,
@@ -7071,7 +7072,8 @@ async fn attach_dev_workspace(
     // (their auto_pull is gone), so remove them from GitHub.
     #[cfg(all(feature = "enterprise", feature = "private"))]
     for (path, hook_id) in stripped_webhooks {
-        if let Ok(url) = windmill_common::git_sync_ee::resolve_repo_url(&db, &dev_w_id, &path).await
+        if let Ok(url) =
+            windmill_common::git_sync_ee::resolve_repo_url_interpolated(&db, &dev_w_id, &path).await
         {
             let _ =
                 windmill_common::git_sync_ee::delete_repo_webhook(&db, &dev_w_id, &url, hook_id)
diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs
index 1166d04fe3..aa89f1ffd5 100644
--- a/backend/windmill-api-workspaces/src/workspaces_extra.rs
+++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs
@@ -805,7 +805,8 @@ pub(crate) async fn change_workspace_id(
     #[cfg(all(feature = "enterprise", feature = "private"))]
     for (path, hook_id) in stale_webhooks {
         if let Ok(url) =
-            windmill_common::git_sync_ee::resolve_repo_url(&db, &rw.new_id, &path).await
+            windmill_common::git_sync_ee::resolve_repo_url_interpolated(&db, &rw.new_id, &path)
+                .await
         {
             let _ =
                 windmill_common::git_sync_ee::delete_repo_webhook(&db, &rw.new_id, &url, hook_id)
diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs
index aeb9fdb329..c95bd70899 100644
--- a/backend/windmill-worker/src/result_processor.rs
+++ b/backend/windmill-worker/src/result_processor.rs
@@ -1081,14 +1081,19 @@ async fn maybe_open_git_sync_deploy_pr(
         return;
     };
 
-    let repo_url =
-        match windmill_common::git_sync_ee::resolve_repo_url(db, workspace_id, &repo_path).await {
-            Ok(url) => url,
-            Err(e) => {
-                tracing::warn!("git sync PR: could not resolve repo url for {repo_path}: {e:#}");
-                return;
-            }
-        };
+    let repo_url = match windmill_common::git_sync_ee::resolve_repo_url_interpolated(
+        db,
+        workspace_id,
+        &repo_path,
+    )
+    .await
+    {
+        Ok(url) => url,
+        Err(e) => {
+            tracing::warn!("git sync PR: could not resolve repo url for {repo_path}: {e:#}");
+            return;
+        }
+    };
     // A fork of a dev workspace diverged from the dev's label branch, so its PR
     // merges back there; everything else targets the tracked branch.
     let pr_base = row.parent_dev_workspace_label.as_deref().unwrap_or(&base);
@@ -1252,9 +1257,22 @@ async fn maybe_post_git_sync_check(
         (None, Some(deploy)) => (true, deploy),
         (None, None) => return,
     };
-    let Ok(check) = serde_json::from_value::<GitSyncCheck>(marker) else {
+    let Ok(mut check) = serde_json::from_value::<GitSyncCheck>(marker) else {
         return;
     };
+    // Markers carry the literal resource URL (job args are persisted, so a
+    // `$var:`-resolved URL must not land there); interpolate before calling
+    // GitHub.
+    check.repo_url =
+        match windmill_common::variables::get_variable_or_self(check.repo_url, db, workspace_id)
+            .await
+        {
+            Ok(u) => u,
+            Err(e) => {
+                tracing::error!("git sync-check: cannot interpolate repo url: {e:#}");
+                return;
+            }
+        };
     // "In sync" on a PR that visibly changes files reads as a bug when those
     // files are outside the repo's sync filters — say what the scope is.
     let scope_note = if !is_deploy && success {