diff --git a/scripts/git-hooks/install.sh b/scripts/git-hooks/install.sh
new file mode 100755
index 0000000..c007dac
--- /dev/null
+++ b/scripts/git-hooks/install.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Chain the ops-log attribution hook onto .git/hooks/post-commit.
+#
+# APPENDS rather than replaces: graphify already owns that file, and
+# core.hooksPath would disable it. Idempotent — safe to re-run.
+set -euo pipefail
+REPO="$(git rev-parse --show-toplevel)"
+HOOK="$REPO/.git/hooks/post-commit"
+if [ ! -f "$HOOK" ]; then
+  printf '#!/bin/sh\n' > "$HOOK"; chmod +x "$HOOK"
+fi
+if grep -q "post-commit-ops-log" "$HOOK"; then
+  echo "already installed"; exit 0
+fi
+printf '\n# ops-log attribution hook (scripts/git-hooks/post-commit-ops-log)\n"$(git rev-parse --show-toplevel)/scripts/git-hooks/post-commit-ops-log" || true\n' >> "$HOOK"
+echo "installed — commits now record their althing handle to the ops log"
diff --git a/scripts/git-hooks/post-commit-ops-log b/scripts/git-hooks/post-commit-ops-log
new file mode 100755
index 0000000..0b42067
--- /dev/null
+++ b/scripts/git-hooks/post-commit-ops-log
@@ -0,0 +1,32 @@
+#!/bin/sh
+# post-commit-ops-log — record who committed, by althing handle.
+#
+# WHY. Two agents (infra-ops and infra-hermes) share ONE checkout of this repo
+# on nh3-dev, and every commit here is attributed to Vuong Hoang by convention.
+# So a commit's author line says nothing about which agent made it. The ops log
+# closed this for HOST changes; it did not cover commits to the shared tree.
+#
+# Found the hard way on 2026-09-19: commit e43e262 appeared interleaved between
+# two of this session's commits, in this session's own reflog, and was
+# unattributable from git, from the ops log AND from the althing bus. It was
+# sitting in the push set at the time.
+#
+# Appended to .git/hooks/post-commit, which already carries the graphify hook.
+# Best-effort by construction: a failure here must never fail a commit.
+[ "${OPS_LOG_SKIP_HOOK:-0}" = "1" ] && exit 0
+
+REPO=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
+[ -x "$REPO/scripts/ops-log" ] || exit 0
+
+SUBJECT=$(git log -1 --format=%s 2>/dev/null)
+SHA=$(git log -1 --format=%h 2>/dev/null)
+FILES=$(git diff --name-only HEAD~1 HEAD 2>/dev/null | wc -l)
+
+"$REPO/scripts/ops-log" record \
+  --host "$(hostname)" \
+  --action commit \
+  --target "$(basename "$REPO")" \
+  --outcome changed \
+  --detail "$SHA ($FILES files): $SUBJECT" \
+  -q >/dev/null 2>&1 || true
+exit 0