diff --git a/.husky/pre-push b/.husky/pre-push
index f607f954d..ad185b85a 100755
--- a/.husky/pre-push
+++ b/.husky/pre-push
@@ -26,13 +26,16 @@ TOTAL_ERRORS=0
 while read local_ref local_sha remote_ref remote_sha; do
   # Get the range of commits being pushed.
   if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
-    # New branch - find the latest published release tag to limit scope.
-    latest_release=$(git tag --list 'v*' --sort=-version:refname --merged "$local_sha" | head -1)
-    if [ -n "$latest_release" ]; then
-      # Check commits since the latest published release.
-      range="$latest_release..$local_sha"
+    # New branch: only check commits not already on the remote default branch.
+    default_branch=$(git symbolic-ref "refs/remotes/${remote}/HEAD" 2>/dev/null | sed "s|refs/remotes/${remote}/||")
+    if [ -z "$default_branch" ]; then
+      default_branch="main"
+    fi
+    # Verify the remote ref exists locally before using it in the range.
+    if git rev-parse --verify "${remote}/${default_branch}" >/dev/null 2>&1; then
+      range="${remote}/${default_branch}..$local_sha"
     else
-      # No release tags found - check all commits.
+      # Remote ref missing (shallow clone, --single-branch, etc.), check all commits.
       range="$local_sha"
     fi
   else
diff --git a/packages/package-builder/package.json b/packages/package-builder/package.json
index 9f307d573..fd866d087 100644
--- a/packages/package-builder/package.json
+++ b/packages/package-builder/package.json
@@ -17,7 +17,7 @@
   "dependencies": {
     "@socketsecurity/lib": "catalog:",
     "build-infra": "workspace:*",
-    "handlebars": "^4.7.8"
+    "handlebars": "^4.7.9"
   },
   "engines": {
     "node": ">=25.5.0"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 23482c1c3..e2e16f6be 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -771,8 +771,8 @@ importers:
         specifier: workspace:*
         version: link:../build-infra
       handlebars:
-        specifier: ^4.7.8
-        version: 4.7.8
+        specifier: ^4.7.9
+        version: 4.7.9
 
 packages:
 
@@ -2805,8 +2805,8 @@ packages:
     resolution: {integrity: sha512-rXunEHF9M9EkMydTBux7+IryYXEZinRk6g8OBOGDBzo/qWJjhTxy86i5q7lQYpCLHN8Sqv1XX3OIOc7ka2gtvQ==}
     engines: {node: '>=8.0.0'}
 
-  handlebars@4.7.8:
-    resolution: {integrity: sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==}
+  handlebars@4.7.9:
+    resolution: {integrity: sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==}
     engines: {node: '>=0.4.7'}
     hasBin: true
 
@@ -6405,7 +6405,7 @@ snapshots:
 
   grad-school@0.0.5: {}
 
-  handlebars@4.7.8:
+  handlebars@4.7.9:
     dependencies:
       minimist: 1.2.8
       neo-async: 2.6.2