diff --git a/.github/workflows/check-style.yml b/.github/workflows/check-style.yml
index 108a2de903310c..b265fe35cbfc51 100644
--- a/.github/workflows/check-style.yml
+++ b/.github/workflows/check-style.yml
@@ -20,7 +20,7 @@ jobs:
       jobname: ClangFormat
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/check-whitespace.yml b/.github/workflows/check-whitespace.yml
index ea6f49f742108e..3379f89a814abd 100644
--- a/.github/workflows/check-whitespace.yml
+++ b/.github/workflows/check-whitespace.yml
@@ -19,7 +19,7 @@ jobs:
   check-whitespace:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 205325eb33b064..44337a67422e01 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -63,7 +63,7 @@ jobs:
           echo "skip_concurrent=$skip_concurrent" >>$GITHUB_OUTPUT
       - name: skip if the commit or tree was already tested
         id: skip-if-redundant
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         if: steps.check-ref.outputs.enabled == 'yes'
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
@@ -112,8 +112,10 @@ jobs:
       group: windows-build-${{ github.ref }}
       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
     steps:
-    - uses: actions/checkout@v6
-    - uses: git-for-windows/setup-git-for-windows-sdk@v2
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1
+      with:
+        architecture: mingw64
     - name: build
       shell: bash
       env:
@@ -123,7 +125,7 @@ jobs:
     - name: zip up tracked files
       run: git archive -o artifacts/tracked.tar.gz HEAD
     - name: upload tracked files and build artifacts
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: windows-artifacts
         path: artifacts
@@ -140,14 +142,16 @@ jobs:
       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
     steps:
     - name: download tracked files and build artifacts
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       with:
         name: windows-artifacts
         path: ${{github.workspace}}
     - name: extract tracked files and build artifacts
       shell: bash
       run: tar xf artifacts.tar.gz && tar xf tracked.tar.gz
-    - uses: git-for-windows/setup-git-for-windows-sdk@v2
+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1
+      with:
+        architecture: mingw64
     - name: test
       shell: bash
       run: . /etc/profile && ci/run-test-slice.sh $((${{matrix.nr}} + 1)) 10
@@ -157,7 +161,7 @@ jobs:
       run: ci/print-test-failures.sh
     - name: Upload failed tests' directories
       if: failure() && env.FAILED_TEST_ARTIFACTS != ''
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: failed-tests-windows-${{ matrix.nr }}
         path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -173,20 +177,22 @@ jobs:
       group: vs-build-${{ github.ref }}
       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
     steps:
-    - uses: actions/checkout@v6
-    - uses: git-for-windows/setup-git-for-windows-sdk@v2
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1
+      with:
+        architecture: mingw64
     - name: initialize vcpkg
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       with:
         repository: 'microsoft/vcpkg'
         path: 'compat/vcbuild/vcpkg'
     - name: download vcpkg artifacts
-      uses: git-for-windows/get-azure-pipelines-artifact@v0
+      uses: git-for-windows/get-azure-pipelines-artifact@2e424b98e1251b725d6064c5f1a9f854a33e5b88 # v0
       with:
         repository: git/git
         definitionId: 9
     - name: add msbuild to PATH
-      uses: microsoft/setup-msbuild@v3
+      uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3
     - name: copy dlls to root
       shell: cmd
       run: compat\vcbuild\vcpkg_copy_dlls.bat release
@@ -208,7 +214,7 @@ jobs:
     - name: zip up tracked files
       run: git archive -o artifacts/tracked.tar.gz HEAD
     - name: upload tracked files and build artifacts
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: vs-artifacts
         path: artifacts
@@ -224,9 +230,11 @@ jobs:
       group: vs-test-${{ matrix.nr }}-${{ github.ref }}
       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
     steps:
-    - uses: git-for-windows/setup-git-for-windows-sdk@v2
+    - uses: git-for-windows/setup-git-for-windows-sdk@aed153d1258c311b680b81584a72a1a4807401f0 # v2.2.1
+      with:
+        architecture: mingw64
     - name: download tracked files and build artifacts
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       with:
         name: vs-artifacts
         path: ${{github.workspace}}
@@ -244,7 +252,7 @@ jobs:
       run: ci/print-test-failures.sh
     - name: Upload failed tests' directories
       if: failure() && env.FAILED_TEST_ARTIFACTS != ''
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: failed-tests-windows-vs-${{ matrix.nr }}
         path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -258,8 +266,8 @@ jobs:
       group: windows-meson-build-${{ github.ref }}
       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
     steps:
-    - uses: actions/checkout@v6
-    - uses: actions/setup-python@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
     - name: Set up dependencies
       shell: pwsh
       run: pip install meson ninja
@@ -270,7 +278,7 @@ jobs:
       shell: pwsh
       run: meson compile -C build
     - name: Upload build artifacts
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: windows-meson-artifacts
         path: build
@@ -286,13 +294,13 @@ jobs:
       group: windows-meson-test-${{ matrix.nr }}-${{ github.ref }}
       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
     steps:
-    - uses: actions/checkout@v6
-    - uses: actions/setup-python@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+    - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
     - name: Set up dependencies
       shell: pwsh
       run: pip install meson ninja
     - name: Download build artifacts
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       with:
         name: windows-meson-artifacts
         path: build
@@ -305,7 +313,7 @@ jobs:
       run: ci/print-test-failures.sh
     - name: Upload failed tests' directories
       if: failure() && env.FAILED_TEST_ARTIFACTS != ''
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: failed-tests-windows-meson-${{ matrix.nr }}
         path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -341,7 +349,7 @@ jobs:
       TEST_OUTPUT_DIRECTORY: ${{github.workspace}}/t
     runs-on: ${{matrix.vector.pool}}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
     - run: ci/install-dependencies.sh
     - run: ci/run-build-and-tests.sh
     - name: print test failures
@@ -349,7 +357,7 @@ jobs:
       run: ci/print-test-failures.sh
     - name: Upload failed tests' directories
       if: failure() && env.FAILED_TEST_ARTIFACTS != ''
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: failed-tests-${{matrix.vector.jobname}}
         path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -362,7 +370,7 @@ jobs:
       CI_JOB_IMAGE: ubuntu-latest
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
     - run: ci/install-dependencies.sh
     - run: ci/run-build-and-minimal-fuzzers.sh
   dockerized:
@@ -411,9 +419,9 @@ jobs:
         # A RHEL 8 compatible distro.  Supported until 2029-05-31.
         - jobname: almalinux-8
           image: almalinux:8
-        # Supported until 2026-08-31.
-        - jobname: debian-11
-          image: debian:11
+        # Supported until 2028-06-30.
+        - jobname: debian-12
+          image: debian:12
     env:
       jobname: ${{matrix.vector.jobname}}
       CC: ${{matrix.vector.cc}}
@@ -441,7 +449,7 @@ jobs:
         else
           apt-get -q update && apt-get -q -y install git
         fi
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
     - run: ci/install-dependencies.sh
     - run: useradd builder --create-home
     - run: chown -R builder .
@@ -451,7 +459,7 @@ jobs:
       run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh
     - name: Upload failed tests' directories
       if: failure() && env.FAILED_TEST_ARTIFACTS != ''
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
       with:
         name: failed-tests-${{matrix.vector.jobname}}
         path: ${{env.FAILED_TEST_ARTIFACTS}}
@@ -466,7 +474,7 @@ jobs:
       group: static-analysis-${{ github.ref }}
       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
     - run: ci/install-dependencies.sh
     - run: ci/run-static-analysis.sh
     - run: ci/check-directional-formatting.bash
@@ -482,7 +490,7 @@ jobs:
       group: rust-analysis-${{ github.ref }}
       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
     - run: ci/install-dependencies.sh
     - run: ci/run-rust-checks.sh
   sparse:
@@ -496,7 +504,7 @@ jobs:
       group: sparse-${{ github.ref }}
       cancel-in-progress: ${{ needs.ci-config.outputs.skip_concurrent == 'yes' }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
     - name: Install other dependencies
       run: ci/install-dependencies.sh
     - run: make sparse
@@ -512,6 +520,6 @@ jobs:
       CI_JOB_IMAGE: ubuntu-latest
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
     - run: ci/install-dependencies.sh
     - run: ci/test-documentation.sh
diff --git a/Documentation/config/push.adoc b/Documentation/config/push.adoc
index 28132eedfee6c0..06a3810587b8e7 100644
--- a/Documentation/config/push.adoc
+++ b/Documentation/config/push.adoc
@@ -132,7 +132,28 @@ This will result in only b (a and c are cleared).
 	sent by rounds of negotiation in which the client and the
 	server attempt to find commits in common. If `false`, Git will
 	rely solely on the server's ref advertisement to find commits
-	in common.
+	in common. Defaults to `false`.
++
+If set to `required`, abort the push before constructing or sending a
+packfile if negotiation fails, including when the server or protocol does
+not support negotiation. With `true`, a negotiation failure only produces
+a warning and the push proceeds.
++
+WebDAV and remote-helper `export` do not support required negotiation.
+Remote-helper `push` requires the helper to advertise
+`push-negotiate-required`; otherwise Git rejects the push before submitting
+it to the helper. Helpers that connect to Git's native protocol use the
+normal negotiation implementation. See linkgit:gitremote-helpers[7].
++
+A successful negotiation need not find any common commits. `required`
+does not limit the size of the resulting packfile or change which commits
+the server acknowledges. On a supported transport, negotiation is skipped
+when there are no negotiation tips, as with a deletion-only push without
+explicitly configured tips. Unsupported transports reject updates, including
+deletions, without starting object transfer. To permit a push after a
+negotiation failure, explicitly use
+`git -c push.negotiate=true push`; to skip negotiation, use
+`git -c push.negotiate=false push`.
 
 `push.useBitmaps`::
 	If set to `false`, disable use of bitmaps for `git push` even if
diff --git a/Documentation/git-version.adoc b/Documentation/git-version.adoc
index 9462043a142838..5920abf3e99d10 100644
--- a/Documentation/git-version.adoc
+++ b/Documentation/git-version.adoc
@@ -30,6 +30,11 @@ detection algorithm and thus may be vulnerable to known SHA-1 collision
 attacks. When a faster SHA-1 implementation without collision detection is used
 for only non-cryptographic purposes, the algorithm is displayed in the form
 `non-collision-detecting-SHA-1: <option>`.
++
+The line `feature: push-negotiate-required` indicates support for
+`push.negotiate=required`, including rejection of unsupported push transports.
+It does not indicate that a particular remote supports negotiation. See
+linkgit:git-config[1].
 
 GIT
 ---
diff --git a/Documentation/gitremote-helpers.adoc b/Documentation/gitremote-helpers.adoc
index 39cdece16e93a4..448ae00966c117 100644
--- a/Documentation/gitremote-helpers.adoc
+++ b/Documentation/gitremote-helpers.adoc
@@ -116,6 +116,20 @@ Supported commands: 'stateless-connect'.
 +
 Supported commands: 'list for-push', 'push'.
 
+'push-negotiate-required'::
+	With 'push', the helper promises to honor `push.negotiate=required`
+	in the inherited Git configuration. When required, supported
+	negotiation must complete successfully before enumerating objects for
+	transfer, constructing a pack, or uploading objects. Failed or
+	unsupported negotiation must fail the push. Successful negotiation
+	may find no common commits. On a supported transport, negotiation may
+	be skipped when there are no negotiation tips, as described for
+	`push.negotiate` in linkgit:git-config[1].
++
+This capability does not enable required negotiation by itself. It does not
+apply to 'export', which Git rejects when negotiation is required because
+Git would start 'fast-export' before the helper can negotiate.
+
 'export'::
 	Can discover remote refs and push specified objects from a
 	fast-import stream to remote refs.
diff --git a/fetch-pack.c b/fetch-pack.c
index 2f64c3d073d890..1a06e2f6a312c9 100644
--- a/fetch-pack.c
+++ b/fetch-pack.c
@@ -2556,6 +2556,20 @@ void negotiate_using_fetch(const struct oid_array *negotiation_restrict_tips,
 		trace2_data_intmax("negotiate_using_fetch", the_repository,
 				   "in_vain", in_vain);
 
+		/*
+		 * Previous responses are complete and there are no new haves.
+		 * An empty request could ask the server to send a pack instead.
+		 * Still send the first request: it may contain only explicit
+		 * negotiation-include commits, which add_haves() does not count.
+		 */
+		if (!haves_added && negotiation_round > 1) {
+			trace2_region_leave_printf("negotiate_using_fetch", "round",
+						   the_repository, "%d",
+						   negotiation_round);
+			negotiation_round--;
+			break;
+		}
+
 		/* Send request */
 		packet_buf_flush(&req_buf);
 		if (write_in_full(fd[1], req_buf.buf, req_buf.len) < 0)
@@ -2588,7 +2602,7 @@ void negotiate_using_fetch(const struct oid_array *negotiation_restrict_tips,
 						 REACH_SCRATCH, 0,
 						 min_generation))
 			last_iteration = 1;
-		trace2_region_leave_printf("negotiation", "round",
+		trace2_region_leave_printf("negotiate_using_fetch", "round",
 					   the_repository, "%d",
 					   negotiation_round);
 	}
diff --git a/help.c b/help.c
index 46241492cee117..0c6d60ffec43b0 100644
--- a/help.c
+++ b/help.c
@@ -804,6 +804,7 @@ void get_version_info(struct strbuf *buf, int show_build_options)
 
 		if (fsmonitor_ipc__is_supported())
 			strbuf_addstr(buf, "feature: fsmonitor--daemon\n");
+		strbuf_addstr(buf, "feature: push-negotiate-required\n");
 #if !defined NO_GETTEXT
 		strbuf_addstr(buf, "gettext: enabled\n");
 #endif
diff --git a/http-push.c b/http-push.c
index b8f3faaed95a31..265f9461459951 100644
--- a/http-push.c
+++ b/http-push.c
@@ -22,6 +22,7 @@
 #include "object-file.h"
 #include "odb.h"
 #include "commit-reach.h"
+#include "send-pack.h"
 
 #ifdef EXPAT_NEEDS_XMLPARSE_H
 #include <xmlparse.h>
@@ -1792,6 +1793,9 @@ int cmd_main(int argc, const char **argv)
 
 	gitdir = setup_git_directory(the_repository);
 
+	if (get_push_negotiation_mode(the_repository) == PUSH_NEGOTIATE_REQUIRED)
+		die(_("WebDAV does not support required push negotiation"));
+
 	memset(remote_dir_exists, -1, 256);
 
 	http_init(NULL, repo->url, 1);
diff --git a/remote-curl.c b/remote-curl.c
index 2c35dd52400f83..52e233bd126fe8 100644
--- a/remote-curl.c
+++ b/remote-curl.c
@@ -1344,6 +1344,9 @@ static int push_dav(const char **specs)
 {
 	struct child_process child = CHILD_PROCESS_INIT;
 
+	if (get_push_negotiation_mode(the_repository) == PUSH_NEGOTIATE_REQUIRED)
+		die(_("WebDAV does not support required push negotiation"));
+
 	child.git_cmd = 1;
 	strvec_push(&child.args, "http-push");
 	strvec_push(&child.args, "--helper-status");
@@ -1645,6 +1648,7 @@ int cmd_main(int argc, const char **argv)
 			printf("get\n");
 			printf("option\n");
 			printf("push\n");
+			printf("push-negotiate-required\n");
 			printf("check-connectivity\n");
 			printf("object-format\n");
 			printf("\n");
diff --git a/send-pack.c b/send-pack.c
index ae661e7e7401b3..a6721dd52936e0 100644
--- a/send-pack.c
+++ b/send-pack.c
@@ -409,12 +409,24 @@ static void reject_invalid_nonce(const char *nonce, int len)
 	}
 }
 
-static void get_commons_through_negotiation(struct repository *r,
-					    const char *url,
-					    const struct string_list *negotiation_include,
-					    const struct string_list *negotiation_restrict,
-					    const struct ref *remote_refs,
-					    struct oid_array *commons)
+enum push_negotiation_mode get_push_negotiation_mode(struct repository *r)
+{
+	const char *value;
+
+	if (repo_config_get_value(r, "push.negotiate", &value))
+		return PUSH_NEGOTIATE_DISABLED;
+	if (value && !strcasecmp(value, "required"))
+		return PUSH_NEGOTIATE_REQUIRED;
+	return git_config_bool("push.negotiate", value) ?
+		PUSH_NEGOTIATE_ENABLED : PUSH_NEGOTIATE_DISABLED;
+}
+
+static int get_commons_through_negotiation(struct repository *r,
+					   const char *url,
+					   const struct string_list *negotiation_include,
+					   const struct string_list *negotiation_restrict,
+					   const struct ref *remote_refs,
+					   struct oid_array *commons)
 {
 	struct child_process child = CHILD_PROCESS_INIT;
 	const struct ref *ref;
@@ -454,7 +466,7 @@ static void get_commons_through_negotiation(struct repository *r,
 
 	if (!nr_negotiation) {
 		child_process_clear(&child);
-		return;
+		return 0;
 	}
 
 	if (start_command(&child))
@@ -475,13 +487,7 @@ static void get_commons_through_negotiation(struct repository *r,
 		oid_array_append(commons, &oid);
 	} while (1);
 
-	if (finish_command(&child)) {
-		/*
-		 * The information that push negotiation provides is useful but
-		 * not mandatory.
-		 */
-		warning(_("push negotiation failed; proceeding anyway with push"));
-	}
+	return finish_command(&child);
 }
 
 int send_pack(struct repository *r,
@@ -503,7 +509,7 @@ int send_pack(struct repository *r,
 	int quiet_supported = 0;
 	int agent_supported = 0;
 	int advertise_sid = 0;
-	int push_negotiate = 0;
+	enum push_negotiation_mode push_negotiate;
 	int use_atomic = 0;
 	int atomic_supported = 0;
 	int use_push_options = 0;
@@ -524,14 +530,19 @@ int send_pack(struct repository *r,
 		goto out;
 	}
 
-	repo_config_get_bool(r, "push.negotiate", &push_negotiate);
+	push_negotiate = get_push_negotiation_mode(r);
 	if (push_negotiate) {
 		trace2_region_enter("send_pack", "push_negotiate", r);
-		get_commons_through_negotiation(r, args->url,
-					       args->negotiation_include,
-					       args->negotiation_restrict,
-					       remote_refs, &commons);
+		ret = get_commons_through_negotiation(r, args->url,
+					      args->negotiation_include,
+					      args->negotiation_restrict,
+					      remote_refs, &commons);
 		trace2_region_leave("send_pack", "push_negotiate", r);
+		if (ret) {
+			if (push_negotiate == PUSH_NEGOTIATE_REQUIRED)
+				die(_("push negotiation failed; aborting push"));
+			warning(_("push negotiation failed; proceeding anyway with push"));
+		}
 	}
 
 	if (!repo_config_get_bool(r, "push.usebitmaps", &use_bitmaps))
diff --git a/send-pack.h b/send-pack.h
index 30be2be0f2b8fb..599b2e286506c9 100644
--- a/send-pack.h
+++ b/send-pack.h
@@ -8,6 +8,16 @@ struct oid_array;
 struct ref;
 struct repository;
 
+/* The push.negotiate policy for attempting negotiation and handling failure. */
+enum push_negotiation_mode {
+	PUSH_NEGOTIATE_DISABLED,
+	PUSH_NEGOTIATE_ENABLED,
+	PUSH_NEGOTIATE_REQUIRED,
+};
+
+/* Read push.negotiate, accepting Boolean values and "required". */
+enum push_negotiation_mode get_push_negotiation_mode(struct repository *r);
+
 /* Possible values for push_cert field in send_pack_args. */
 #define SEND_PACK_PUSH_CERT_NEVER 0
 #define SEND_PACK_PUSH_CERT_IF_ASKED 1
diff --git a/t/meson.build b/t/meson.build
index 7f53cca7d1f891..3ddf799453737d 100644
--- a/t/meson.build
+++ b/t/meson.build
@@ -707,6 +707,7 @@ integration_tests = [
   't5553-set-upstream.sh',
   't5554-noop-fetch-negotiator.sh',
   't5555-http-smart-common.sh',
+  't5556-push-negotiate.sh',
   't5557-http-get.sh',
   't5558-clone-bundle-uri.sh',
   't5559-http-fetch-smart-http2.sh',
diff --git a/t/t5549-fetch-push-http.sh b/t/t5549-fetch-push-http.sh
index 2cdebcb7356332..9b3befdaa11f2c 100755
--- a/t/t5549-fetch-push-http.sh
+++ b/t/t5549-fetch-push-http.sh
@@ -69,4 +69,87 @@ EOF
 	test_cmp warning-expect warning-actual
 '
 
+test_expect_success 'push with required negotiation' '
+	setup_client_and_server &&
+	test_when_finished "rm -f event" &&
+	GIT_TRACE2_EVENT="$PWD/event" \
+		git -C client -c protocol.version=2 -c push.negotiate=required \
+		push "$URI" main:refs/remotes/origin/main &&
+	grep_wrote 3 event
+'
+
+for status in 400 500
+do
+	for mode in true required
+	do
+		test_expect_success "push.negotiate=$mode with HTTP $status during negotiation" '
+			setup_client_and_server &&
+			test_when_finished "rm -f event \"$HTTPD_ROOT_PATH/one-time-script\"" &&
+			write_script "$HTTPD_ROOT_PATH/one-time-script" <<-EOF &&
+			if test "\$REQUEST_METHOD" = POST &&
+			   test "\${PATH_INFO##*/}" = git-upload-pack
+			then
+				printf "Status: $status Test failure\\r\\n"
+				printf "Content-Type: text/plain\\r\\n\\r\\n"
+				echo "negotiation failed"
+			else
+				cat "\$1"
+			fi
+			EOF
+			if test "$mode" = required
+			then
+				test_must_fail env GIT_TRACE2_EVENT="$PWD/event" \
+					git -C client -c protocol.version=2 -c push.negotiate=$mode \
+					push "$HTTPD_URL/one_time_script/server" \
+					main:refs/remotes/origin/main 2>err &&
+				test_grep "push negotiation failed; aborting push" err &&
+				test_grep ! "proceeding anyway" err &&
+				test_grep ! "pack-objects" event &&
+				test_must_fail git -C "$SERVER" show-ref --verify refs/remotes/origin/main
+			else
+				GIT_TRACE2_EVENT="$PWD/event" \
+					git -C client -c protocol.version=2 -c push.negotiate=$mode \
+					push "$HTTPD_URL/one_time_script/server" \
+					main:refs/remotes/origin/main 2>err &&
+				test_grep "push negotiation failed; proceeding anyway" err &&
+				grep_wrote 6 event
+			fi &&
+			test_grep "HTTP $status" err &&
+			test_path_is_missing "$HTTPD_ROOT_PATH/one-time-script"
+		'
+	done
+done
+
+test_expect_success 'required negotiation rejects a missing wait-for-done capability' '
+	setup_client_and_server &&
+	test_when_finished "rm -f event \"$HTTPD_ROOT_PATH/one-time-script\"" &&
+	write_script "$HTTPD_ROOT_PATH/one-time-script" <<-\EOF &&
+	sed "s/ wait-for-done/ xxxx-xxx-xxxx/" "$1"
+	EOF
+	test_must_fail env GIT_TRACE2_EVENT="$PWD/event" \
+		git -C client -c protocol.version=2 -c push.negotiate=required \
+		push "$HTTPD_URL/one_time_script/server" \
+		main:refs/remotes/origin/main 2>err &&
+	test_grep "server does not support wait-for-done" err &&
+	test_grep "push negotiation failed; aborting push" err &&
+	test_grep ! "pack-objects" event &&
+	test_must_fail git -C "$SERVER" show-ref --verify refs/remotes/origin/main
+'
+
+test_expect_success 'required negotiation rejects an invalid acknowledgments section' '
+	setup_client_and_server &&
+	test_when_finished "rm -f event \"$HTTPD_ROOT_PATH/one-time-script\"" &&
+	write_script "$HTTPD_ROOT_PATH/one-time-script" <<-\EOF &&
+	sed "s/acknowledgments/not-ack-section/" "$1"
+	EOF
+	test_must_fail env GIT_TRACE2_EVENT="$PWD/event" \
+		git -C client -c protocol.version=2 -c push.negotiate=required \
+		push "$HTTPD_URL/one_time_script/server" \
+		main:refs/remotes/origin/main 2>err &&
+	test_grep "expected .acknowledgments." err &&
+	test_grep "push negotiation failed; aborting push" err &&
+	test_grep ! "pack-objects" event &&
+	test_must_fail git -C "$SERVER" show-ref --verify refs/remotes/origin/main
+'
+
 test_done
diff --git a/t/t5556-push-negotiate.sh b/t/t5556-push-negotiate.sh
new file mode 100755
index 00000000000000..cd32b3e8cf5675
--- /dev/null
+++ b/t/t5556-push-negotiate.sh
@@ -0,0 +1,328 @@
+#!/bin/sh
+
+test_description='required negotiation before constructing a push pack'
+
+GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME=main
+export GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME
+
+. ./test-lib.sh
+
+setup_push () {
+	test_when_finished "rm -rf client server" &&
+	git init client &&
+	test_commit -C client base &&
+	test_commit -C client tip &&
+	git init --bare server &&
+	git -C client remote add origin ../server
+}
+
+setup_common () {
+	setup_push &&
+	git -C client push origin base:refs/heads/base &&
+	git -C server config receive.hideRefs refs/heads/base
+}
+
+check_no_pack () {
+	test_grep ! "pack-objects" trace &&
+	test_grep ! "proceeding anyway" err &&
+	test_must_fail git -C server show-ref --verify refs/heads/main
+}
+
+for mode in true required
+do
+	test_expect_success "push.negotiate=$mode finds hidden common history" '
+		setup_common &&
+		test_when_finished "rm -f trace" &&
+		GIT_TRACE2_EVENT="$PWD/trace" \
+			git -C client -c protocol.version=2 -c push.negotiate=$mode \
+			push origin main &&
+		test_grep "write_pack_file/wrote.*\"value\":\"3\"" trace &&
+		git -C client rev-parse main >expect &&
+		git -C server rev-parse main >actual &&
+		test_cmp expect actual
+	'
+done
+
+test_expect_success 'required negotiation can succeed without a common commit' '
+	setup_push &&
+	test_when_finished "rm -f trace packet" &&
+	GIT_TRACE2_EVENT="$PWD/trace" GIT_TRACE_PACKET="$PWD/packet" \
+		git -C client -c protocol.version=2 -c push.negotiate=required \
+		push origin main &&
+	test_grep "fetch< NAK" packet &&
+	test_grep ! "fetch< ACK" packet &&
+	test_grep "write_pack_file/wrote.*\"value\":\"6\"" trace &&
+	git -C client rev-parse main >expect &&
+	git -C server rev-parse main >actual &&
+	test_cmp expect actual
+'
+
+for version in 0 1
+do
+	test_expect_success "required negotiation rejects protocol v$version before packing" '
+		setup_common &&
+		test_when_finished "rm -f trace" &&
+		test_must_fail env GIT_TRACE2_EVENT="$PWD/trace" \
+			git -C client -c protocol.version=$version \
+			-c push.negotiate=required push origin main 2>err &&
+		test_grep "requires protocol v2" err &&
+		test_grep "push negotiation failed; aborting push" err &&
+		check_no_pack
+	'
+done
+
+for mode in true false
+do
+	test_expect_success "explicit push.negotiate=$mode overrides required" '
+		setup_common &&
+		test_config -C client push.negotiate required &&
+		test_when_finished "rm -f trace" &&
+		GIT_TRACE2_EVENT="$PWD/trace" \
+			git -C client -c protocol.version=0 -c push.negotiate=$mode \
+			push origin main 2>err &&
+		test_grep "write_pack_file/wrote.*\"value\":\"6\"" trace &&
+		if test "$mode" = true
+		then
+			test_grep "push negotiation failed; proceeding anyway" err
+		else
+			test_grep ! "push negotiation failed" err
+		fi
+	'
+done
+
+test_expect_success 'push.negotiate preserves boolean spellings' '
+	setup_common &&
+	for mode in yes on 1 no off 0 ""
+	do
+		git -C client -c push.negotiate="$mode" \
+			push --dry-run origin main || return 1
+	done &&
+	git -C client -c push.negotiate push --dry-run origin main
+'
+
+test_expect_success 'invalid push.negotiate fails before packing' '
+	setup_common &&
+	test_when_finished "rm -f trace" &&
+	test_must_fail env GIT_TRACE2_EVENT="$PWD/trace" \
+		git -C client -c push.negotiate=invalid push origin main 2>err &&
+	test_grep "bad boolean config value" err &&
+	check_no_pack
+'
+
+test_expect_success 'deletion-only push does not require negotiation' '
+	setup_common &&
+	git -C server config --unset receive.hideRefs &&
+	test_when_finished "rm -f trace" &&
+	GIT_TRACE2_EVENT="$PWD/trace" \
+		git -C client -c protocol.version=0 -c push.negotiate=required \
+		push origin :base &&
+	test_grep ! "negotiate-only" trace &&
+	test_grep ! "pack-objects" trace &&
+	test_must_fail git -C server show-ref --verify refs/heads/base
+'
+
+setup_ssh_push () {
+	setup_common &&
+	write_script ssh-wrapper <<-\EOF &&
+	if test "$1" = -o
+	then
+		shift 2
+	fi
+	shift
+	case "$1" in
+	git-upload-pack*) exec "$NEGOTIATION_SCRIPT" ;;
+	*) exec sh -c "$1" ;;
+	esac
+	EOF
+	test_config -C client remote.origin.url "testhost:$PWD/server" &&
+	test_config -C client ssh.variant ssh
+}
+
+test_expect_success 'required negotiation stops on transport failure' '
+	setup_ssh_push &&
+	write_script failed-upload-pack <<-\EOF &&
+	exit 1
+	EOF
+	test_when_finished "rm -f trace" &&
+	test_must_fail env GIT_TRACE2_EVENT="$PWD/trace" \
+		GIT_SSH="$PWD/ssh-wrapper" \
+		NEGOTIATION_SCRIPT="$PWD/failed-upload-pack" \
+		git -C client -c push.negotiate=required push origin main 2>err &&
+	test_grep "Could not read from remote repository" err &&
+	test_grep "push negotiation failed; aborting push" err &&
+	check_no_pack
+'
+
+test_expect_success !MINGW 'required negotiation stops when negotiation is interrupted' '
+	setup_ssh_push &&
+	write_script interrupted-upload-pack <<-\EOF &&
+	# GIT_SSH executes this script directly, so its parent is fetch.
+	kill -TERM "$PPID"
+	EOF
+	test_when_finished "rm -f trace" &&
+	test_must_fail env GIT_TRACE2_EVENT="$PWD/trace" \
+		GIT_SSH="$PWD/ssh-wrapper" \
+		NEGOTIATION_SCRIPT="$PWD/interrupted-upload-pack" \
+		git -C client -c push.negotiate=required push origin main 2>err &&
+	test_grep "\"code\":143" trace &&
+	test_grep "push negotiation failed; aborting push" err &&
+	check_no_pack
+'
+
+test_expect_success 'Git advertises complete required-negotiation support' '
+	git version --build-options >build-options &&
+	test_grep "^feature: push-negotiate-required$" build-options
+'
+
+setup_push_helper () {
+	setup_push &&
+	write_script git-remote-no-push-negotiate <<-\EOF &&
+	while IFS= read -r line
+	do
+		printf "%s\n" "$line" >>"$HELPER_LOG"
+		case "$line" in
+		capabilities)
+			echo push
+			echo option
+			if test "$HELPER_CONNECT" = true
+			then
+				echo connect
+			fi
+			echo
+			;;
+		list*) echo ;;
+		option*) echo unsupported ;;
+		connect*) echo fallback ;;
+		push\ *) printf "ok refs/heads/main\n\n" ;;
+		"") break ;;
+		esac
+	done
+	EOF
+	>helper-log
+}
+
+for connect in false true
+do
+	test_expect_success "required negotiation rejects an unsupported push helper (connect=$connect)" '
+		setup_push_helper &&
+		test_must_fail env PATH="$PWD:$PATH" HELPER_LOG="$PWD/helper-log" \
+			HELPER_CONNECT=$connect \
+			git -C client -c push.negotiate=required \
+			push no-push-negotiate::unused main 2>err &&
+		test_grep "does not support required push negotiation" err &&
+		test_grep ! "^push " helper-log
+	'
+done
+
+for mode in true false
+do
+	test_expect_success "push.negotiate=$mode does not require helper support" '
+		setup_push_helper &&
+		env PATH="$PWD:$PATH" HELPER_LOG="$PWD/helper-log" \
+			HELPER_CONNECT=false \
+			git -C client -c push.negotiate=$mode \
+			push no-push-negotiate::unused main &&
+		test_grep "^push " helper-log
+	'
+done
+
+test_expect_success 'required negotiation works through helper connect takeover' '
+	setup_common &&
+	write_script git-remote-negotiate-connect <<-\EOF &&
+	helper_dir=$2
+	while IFS= read -r line
+	do
+		case "$line" in
+		capabilities) printf "connect\n\n" ;;
+		"connect git-receive-pack")
+			echo
+			exec git receive-pack "$helper_dir"
+			;;
+		"connect git-upload-pack")
+			echo
+			GIT_PROTOCOL=version=2
+			export GIT_PROTOCOL
+			exec git upload-pack "$helper_dir"
+			;;
+		*) exit 1 ;;
+		esac
+	done
+	EOF
+	env PATH="$PWD:$PATH" git -C client -c push.negotiate=required \
+		push "negotiate-connect::$PWD/server" main &&
+	git -C client rev-parse main >expect &&
+	git -C server rev-parse main >actual &&
+	test_cmp expect actual
+'
+
+# Keep HTTP tests last so missing HTTPD support does not skip the local tests.
+LIB_HTTPD_DAV=t
+. "$TEST_DIRECTORY"/lib-httpd.sh
+start_httpd
+
+setup_dav_push () {
+	setup_push &&
+	git -C client push origin base:refs/heads/main &&
+	DAV_SERVER="$HTTPD_DOCUMENT_ROOT_PATH/dav.git" &&
+	DAV_URI="$HTTPD_URL/dumb/dav.git" &&
+	test_when_finished "rm -rf \"$DAV_SERVER\"" &&
+	cp -R server "$DAV_SERVER" &&
+	git -C "$DAV_SERVER" update-server-info &&
+	git -C "$DAV_SERVER" rev-parse refs/heads/main >before
+}
+
+for mode in true false
+do
+	test_expect_success REFFILES "WebDAV retains push.negotiate=$mode behavior" '
+		setup_dav_push &&
+		git -C client -c push.negotiate=$mode push "$DAV_URI" main &&
+		git -C client rev-parse main >expect &&
+		git -C "$DAV_SERVER" rev-parse main >actual &&
+		test_cmp expect actual
+	'
+done
+
+test_expect_success REFFILES 'required negotiation rejects WebDAV before starting http-push' '
+	setup_dav_push &&
+	test_when_finished "rm -f dav-event dav-curl" &&
+	test_must_fail env GIT_TRACE2_EVENT="$PWD/dav-event" \
+		GIT_TRACE_CURL="$PWD/dav-curl" \
+		git -C client -c push.negotiate=required push "$DAV_URI" main 2>err &&
+	test_grep "WebDAV does not support required push negotiation" err &&
+	test_grep ! "http-push" dav-event &&
+	test_grep ! "Send header: LOCK" dav-curl &&
+	test_grep ! "Send header: PUT" dav-curl &&
+	git -C "$DAV_SERVER" rev-parse main >after &&
+	test_cmp before after
+'
+
+test_expect_success REFFILES 'direct http-push rejects required negotiation before HTTP requests' '
+	setup_dav_push &&
+	test_when_finished "rm -f dav-curl" &&
+	>dav-curl &&
+	test_must_fail env GIT_TRACE_CURL="$PWD/dav-curl" \
+		git -C client -c push.negotiate=required http-push \
+		"$DAV_URI" refs/heads/main:refs/heads/main 2>err &&
+	test_grep "WebDAV does not support required push negotiation" err &&
+	test_must_be_empty dav-curl &&
+	git -C "$DAV_SERVER" rev-parse main >after &&
+	test_cmp before after
+'
+
+test_expect_success REFFILES 'required WebDAV negotiation rejects mixed deletion and update without mutation' '
+	setup_dav_push &&
+	git -C "$DAV_SERVER" update-ref refs/heads/aaa "$(cat before)" &&
+	git -C "$DAV_SERVER" update-server-info &&
+	test_when_finished "rm -f dav-event" &&
+	test_must_fail env GIT_TRACE2_EVENT="$PWD/dav-event" \
+		git -C client -c push.negotiate=required push "$DAV_URI" \
+		:aaa main:main 2>err &&
+	test_grep "WebDAV does not support required push negotiation" err &&
+	test_grep ! "http-push" dav-event &&
+	git -C "$DAV_SERVER" rev-parse main >after &&
+	test_cmp before after &&
+	git -C "$DAV_SERVER" rev-parse aaa >after &&
+	test_cmp before after
+'
+
+test_done
diff --git a/t/t5702-protocol-v2.sh b/t/t5702-protocol-v2.sh
index 92a6d8530809f0..38c81e1fcd3c53 100755
--- a/t/t5702-protocol-v2.sh
+++ b/t/t5702-protocol-v2.sh
@@ -912,6 +912,46 @@ test_expect_success 'file:// --negotiate-only' '
 	test_grep "$COMMON" out
 '
 
+for algorithm in consecutive skipping
+do
+	test_expect_success "file:// --negotiate-only with no common commits ($algorithm)" '
+		test_when_finished "rm -rf unrelated-client unrelated-server" &&
+		git init unrelated-client &&
+		test_commit -C unrelated-client one &&
+		test_commit -C unrelated-client two &&
+		git init --bare unrelated-server &&
+		test_when_finished "rm -f negotiate-packet negotiate-event" &&
+		GIT_TRACE_PACKET="$PWD/negotiate-packet" \
+		GIT_TRACE2_EVENT="$PWD/negotiate-event" \
+		git -C unrelated-client -c protocol.version=2 \
+			-c fetch.negotiationAlgorithm=$algorithm \
+			fetch --negotiate-only --negotiation-tip=HEAD \
+			"file://$PWD/unrelated-server" >out &&
+		test_must_be_empty out &&
+		test_grep "fetch< NAK" negotiate-packet &&
+		test_grep ! "fetch< ACK" negotiate-packet &&
+		test_grep ! "pack-objects" negotiate-event &&
+		test_grep "\"key\":\"total_rounds\",\"value\":\"1\"" negotiate-event
+	'
+done
+
+for algorithm in consecutive skipping
+do
+	test_expect_success "file:// --negotiate-only with only included commits ($algorithm)" '
+		setup_negotiate_only server "file://$PWD/server" &&
+		test_when_finished "rm -f negotiate-event" &&
+		GIT_TRACE2_EVENT="$PWD/negotiate-event" \
+		git -C client -c protocol.version=2 \
+			-c fetch.negotiationAlgorithm=$algorithm \
+			fetch --negotiate-only --negotiation-tip=one \
+			--negotiation-include=one origin >out &&
+		git -C client rev-parse one >expect &&
+		test_cmp expect out &&
+		test_grep "\"key\":\"haves_added\",\"value\":\"0\"" negotiate-event &&
+		test_grep "\"key\":\"total_rounds\",\"value\":\"1\"" negotiate-event
+	'
+done
+
 test_expect_success 'file:// --negotiate-only with protocol v0' '
 	SERVER="server" &&
 	URI="file://$(pwd)/server" &&
@@ -1619,6 +1659,25 @@ test_expect_success 'http:// --negotiate-only' '
 	test_grep "$COMMON" out
 '
 
+test_expect_success 'http:// --negotiate-only with no common commits' '
+	test_when_finished "rm -rf unrelated-client \"$HTTPD_DOCUMENT_ROOT_PATH/unrelated-server\"" &&
+	git init unrelated-client &&
+	test_commit -C unrelated-client one &&
+	test_commit -C unrelated-client two &&
+	git init --bare "$HTTPD_DOCUMENT_ROOT_PATH/unrelated-server" &&
+	test_when_finished "rm -f negotiate-packet negotiate-event" &&
+	GIT_TRACE_PACKET="$PWD/negotiate-packet" \
+	GIT_TRACE2_EVENT="$PWD/negotiate-event" \
+	git -C unrelated-client -c protocol.version=2 fetch \
+		--negotiate-only --negotiation-tip=HEAD \
+		"$HTTPD_URL/smart/unrelated-server" >out &&
+	test_must_be_empty out &&
+	test_grep "fetch< NAK" negotiate-packet &&
+	test_grep ! "fetch< ACK" negotiate-packet &&
+	test_grep ! "packfile" negotiate-packet &&
+	test_grep "\"key\":\"total_rounds\",\"value\":\"1\"" negotiate-event
+'
+
 test_expect_success 'http:// --negotiate-only without wait-for-done support' '
 	SERVER="server" &&
 	URI="$HTTPD_URL/one_time_script/server" &&
diff --git a/t/t5801-remote-helpers.sh b/t/t5801-remote-helpers.sh
index 5fafc857b85627..ef03dff9de0495 100755
--- a/t/t5801-remote-helpers.sh
+++ b/t/t5801-remote-helpers.sh
@@ -80,6 +80,29 @@ test_expect_success 'pushing to local repo' '
 	compare_refs local HEAD server HEAD
 '
 
+for mode in true false required
+do
+	test_expect_success "export helper with push.negotiate=$mode" '
+		test_when_finished "rm -rf export-server export-client export-trace" &&
+		git clone server export-server &&
+		git clone "testgit::$PWD/export-server" export-client &&
+		test_commit -C export-client outgoing &&
+		git -C export-server rev-parse HEAD >before &&
+		if test "$mode" = required
+		then
+			test_must_fail env GIT_TRACE2_EVENT="$PWD/export-trace" \
+				git -C export-client -c push.negotiate=$mode push 2>err &&
+			test_grep "required push negotiation is not supported with helper export" err &&
+			test_grep ! "fast-export" export-trace &&
+			git -C export-server rev-parse HEAD >after &&
+			test_cmp before after
+		else
+			git -C export-client -c push.negotiate=$mode push &&
+			compare_refs export-client HEAD export-server HEAD
+		fi
+	'
+done
+
 test_expect_success 'fetch new branch' '
 	(cd server &&
 	 git reset --hard &&
diff --git a/transport-helper.c b/transport-helper.c
index d5a064d386e35b..fb214ba9cfa67e 100644
--- a/transport-helper.c
+++ b/transport-helper.c
@@ -20,6 +20,7 @@
 #include "transport-internal.h"
 #include "protocol.h"
 #include "packfile.h"
+#include "send-pack.h"
 
 static int debug;
 
@@ -33,6 +34,8 @@ struct helper_data {
 		export : 1,
 		option : 1,
 		push : 1,
+		/* The helper enforces inherited push.negotiate=required. */
+		push_negotiate_required : 1,
 		connect : 1,
 		stateless_connect : 1,
 		signed_tags : 1,
@@ -203,6 +206,8 @@ static struct child_process *get_helper(struct transport *transport)
 			data->option = 1;
 		else if (!strcmp(capname, "push"))
 			data->push = 1;
+		else if (!strcmp(capname, "push-negotiate-required"))
+			data->push_negotiate_required = 1;
 		else if (!strcmp(capname, "import"))
 			data->import = 1;
 		else if (!strcmp(capname, "bidi-import"))
@@ -1109,6 +1114,11 @@ static int push_refs_with_push(struct transport *transport,
 		return 0;
 	}
 
+	if (get_push_negotiation_mode(the_repository) == PUSH_NEGOTIATE_REQUIRED &&
+	    !data->push_negotiate_required)
+		die(_("helper %s does not support required push negotiation"),
+		    data->name);
+
 	for_each_string_list_item(cas_option, &cas_options)
 		set_helper_option(transport, "cas", cas_option->string);
 	set_common_push_options(transport, data->name, flags);
@@ -1130,6 +1140,10 @@ static int push_refs_with_export(struct transport *transport,
 	struct string_list revlist_args = STRING_LIST_INIT_DUP;
 	struct strbuf buf = STRBUF_INIT;
 
+	/* Git starts fast-export before the helper can negotiate the export. */
+	if (get_push_negotiation_mode(the_repository) == PUSH_NEGOTIATE_REQUIRED)
+		die(_("required push negotiation is not supported with helper export"));
+
 	if (!data->rs.nr)
 		die(_("remote-helper doesn't support push; refspec needed"));