diff --git a/.agents/skills/pr-description/SKILL.md b/.agents/skills/pr-description/SKILL.md
index f9b0fac9c..c6486c782 100644
--- a/.agents/skills/pr-description/SKILL.md
+++ b/.agents/skills/pr-description/SKILL.md
@@ -62,6 +62,16 @@ Write 1-3 concise sentences explaining the reason for the change. Tie it to the
 
 Name affected screens, flows, platforms, users, modules, or developer workflows. Use a short sentence or compact bullets. If impact is unclear, leave a placeholder comment instead of guessing.
 
+### Risk Classification
+
+Add the appropriate `risk:*` label when the PR is opened. If the label is unknown, escalate instead of guessing.
+
+- `risk:low` for config, copy, or minor UI tweaks with low blast radius.
+- `risk:medium` for feature work or refactors touching multiple files.
+- `risk:high` for auth, payments, migrations, or security-sensitive code.
+
+If the branch or user request does not make the risk obvious, leave the template placeholder and call out the uncertainty in Notes.
+
 ### How did you test this?
 
 List commands run and manual checks performed. Keep the existing checklist from the template and check only items that are supported by evidence or explicitly provided by the user.
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index a0878d3de..bfe6fc5da 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -35,6 +35,25 @@ _**Why** did you make these changes? This is your opportunity to provide the rat
 _Does your code affect something downstream? Are there side effects people should know about? Tag any developers that should be kept abreast of this change._
 -->
 
+---
+
+### Layer 2: Risk Classification
+
+Author applies a risk label when opening the PR. When in doubt, escalate.
+
+| Label | When to use |
+| --- | --- |
+| `risk:low` | Config, copy, minor UI tweaks. Low blast radius. |
+| `risk:medium` | Feature work, refactors touching multiple files. |
+| `risk:high` | Auth, payments, migrations, security-sensitive code. |
+
+**Setup**
+
+- [ ] Create `risk:low`, `risk:medium`, `risk:high` labels in the repo
+- [ ] Add risk criteria to contributing guide or PR template
+- [ ] Add reminder in PR template to apply the label before requesting review
+- [ ] Define who can override/escalate (suggested: tech lead)
+
 ## How did you test this?
 
 <!---
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 100644
index 000000000..a330e3807
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1,98 @@
+  # Copilot Instructions
+
+  ## Project
+  React Native + Expo template maintained by Rootstrap. Production-ready starting point for mobile apps targeting iOS, Android, and Web, used as the base for client projects and internal tooling. Ships onboarding, Devise Token Auth authentication, a paginated feed, and settings out of the box.
+
+  Full details in `AGENTS.md`, `agent_docs/architecture.md`, `agent_docs/conventions.md`, and `REVIEW.md` (code review checklist) at the repo root — read these before non-trivial changes.
+
+  ## Stack
+  - React Native 0.81, Expo SDK 54, React 19, TypeScript 5
+  - Expo Router (file-based routing, `src/app/`)
+  - NativeWind (Tailwind for React Native) + `tailwind-variants`
+  - TanStack Query via `react-query-kit`, Axios, `@lukemorales/query-key-factory`
+  - Zustand (imperative auth store) + React Context (`AuthProvider`, reactive UI auth)
+  - `react-hook-form` + `zod` for forms
+  - `react-native-mmkv` for storage, `dayjs` for dates, `expo-crypto` for IDs
+  - `moti` / `react-native-reanimated` for animation
+  - `@shopify/flash-list` for lists, `react-i18next` for i18n
+  - Jest + `@testing-library/react-native` for tests, Maestro for e2e
+  - Package manager: pnpm only (enforced via `preinstall`)
+
+  ## Conventions
+  - Functional components only, no class components
+  - TypeScript strict mode — avoid `any`
+  - API hooks: use `createMutation` / `createQuery` from `react-query-kit`, never raw `useMutation` / `useQuery`; place at `src/api/<domain>/use-<action>.ts`
+  - New query domains must be registered in `src/api/query-factory.ts`
+  - Styling: NativeWind `className` on primitives; `tailwind-variants` for multi-state components; `StyleSheet.create` only for root layout containers
+  - Forms: `react-hook-form` + `zod` resolver, type via `z.infer`, no `useState` for form state, no `Alert.alert()` for validation errors
+  - Strings: always through `useTranslation()`, keys defined in `src/translations/en.json`
+  - Write camelCase in TypeScript everywhere — Axios interceptors handle camelCase↔snake_case conversion, never do it manually
+  - Auth/routing guards live only in `src/app/_layout.tsx` via `Stack.Protected` — never inside screen components
+  - Storage access only through helpers in `src/lib/storage.tsx` (`getItem`/`setItem`/`removeItem`) or auth helpers (`storeTokens`/`getTokenDetails`/`clearTokens`) — never call `storage`/`authStorage` directly
+  - Lists that can grow: `@shopify/flash-list`, never `FlatList`
+  - IDs: `expo-crypto`, never `Math.random()` / `Date.now()`
+  - Never hardcode env values — use `Env` from `@/lib/env`
+
+  ## What to focus on in reviews
+  - Auth or redirect logic added inside screen components instead of `_layout.tsx`
+  - Manual camelCase/snake_case conversion duplicating the interceptors
+  - Raw `useMutation`/`useQuery` instead of `react-query-kit` factories
+  - Direct `storage`/`authStorage` access bypassing helper functions
+  - Hardcoded secrets, API keys, or environment-specific values
+  - Missing translation keys or dynamically constructed i18n keys
+  - `FlatList` used for growing/feed-style content instead of `FlashList`
+  - Unhandled async errors
+  - New dependencies not verified for Expo SDK 54 / RN 0.81 compatibility
+  - Accessibility issues (missing labels, keyboard navigation)
+
+## Classify
+
+Every code review comment must include one of the following labels:
+
+| Label | Meaning |
+|-------|---------|
+| `ai:clean` | No significant issues found. The code follows the project conventions and no changes are required. |
+| `ai:minor` | Minor issues such as style, readability, maintainability, naming, small performance improvements, or convention violations that are not likely to cause bugs. |
+| `ai:serious` | Significant issues including security vulnerabilities, logic errors, crashes, data corruption, broken functionality, race conditions, missing error handling, or architectural violations that should be fixed before merging. |
+
+### Review Rules
+
+- Every review comment **must** start with one of the labels above.
+- Do **not** use more than one label per comment.
+- Only create review comments for actionable issues.
+- If no issues are found, leave a single review comment labeled `ai:clean` indicating the review passed.
+
+### Overall Review Classification
+
+The **main (summary) review comment** must also include a single overall classification label representing the entire review:
+
+- `ai:clean` — No significant issues found.
+- `ai:minor` — Only minor suggestions were found.
+- `ai:serious` — At least one serious issue was identified.
+
+Determine the overall label using the highest severity found during the review:
+
+- If any comment is `ai:serious`, the overall review must be `ai:serious`.
+- Otherwise, if any comment is `ai:minor`, the overall review must be `ai:minor`.
+- Otherwise, the overall review must be `ai:clean`.
+
+The summary should begin with the overall label, for example:
+
+```
+Overall Review: ai:minor
+
+Summary:
+- 2 minor convention violations
+- No security or correctness issues
+```
+
+or
+
+```
+Overall Review: ai:serious
+
+Summary:
+- Logic bug in authentication flow
+- Missing async error handling
+- Hardcoded environment value
+```
\ No newline at end of file
diff --git a/.github/scripts/gatekeeper.js b/.github/scripts/gatekeeper.js
new file mode 100644
index 000000000..590f567b4
--- /dev/null
+++ b/.github/scripts/gatekeeper.js
@@ -0,0 +1,136 @@
+// Layer 4 - Classification and Routing Gatekeeper
+//
+// Routing table (required approvals):
+//
+//   Risk \ AI findings | clean | minor | serious
+//   -------------------|-------|-------|--------
+//   low                |   0   |   0   |    1
+//   medium             |   0   |   1   |    2
+//   high               |   1   |   2   |    2
+
+const ROUTING_TABLE = {
+  low: { clean: 0, minor: 0, serious: 1 },
+  medium: { clean: 0, minor: 1, serious: 2 },
+  high: { clean: 1, minor: 2, serious: 2 },
+};
+
+// Resolve the PR number and head SHA depending on the triggering event.
+async function resolvePr({ github, context, core }) {
+  if (context.eventName === 'pull_request' || context.eventName === 'pull_request_review') {
+    return {
+      prNumber: context.payload.pull_request.number,
+      headSha: context.payload.pull_request.head.sha,
+    };
+  }
+
+  if (context.eventName === 'check_suite') {
+    // check_suite doesn't directly reference a PR; find the associated open PR.
+    const headBranch = context.payload.check_suite.head_branch;
+
+    const { data: prs } = await github.rest.pulls.list({
+      owner: context.repo.owner,
+      repo: context.repo.repo,
+      state: 'open',
+      head: `${context.repo.owner}:${headBranch}`,
+    });
+
+    if (prs.length === 0) {
+      core.info('check_suite: no open PR found for this branch, skipping.');
+      return null;
+    }
+
+    return { prNumber: prs[0].number, headSha: context.payload.check_suite.head_sha };
+  }
+
+  core.info(`Unhandled event: ${context.eventName}`);
+  return null;
+}
+
+// Determine required approvals from the risk:* and ai:* labels.
+function getRoutingDecision(labelNames) {
+  const riskLabel = labelNames.find(l => l.startsWith('risk:'));
+  const riskKey = riskLabel ? riskLabel.replace('risk:', '') : null;
+
+  const aiLabel = labelNames.find(l => l.startsWith('ai:'));
+  const aiKey = aiLabel ? aiLabel.replace('ai:', '') : null;
+
+  if (!riskKey || !aiKey) {
+    // Labels not yet applied — stay pending so the PR can't slip through.
+    return { riskKey, aiKey, requiredApprovals: null, statusDescription: 'Waiting for risk and AI labels to be applied.' };
+  }
+
+  if (!ROUTING_TABLE[riskKey] || ROUTING_TABLE[riskKey][aiKey] === undefined) {
+    return { riskKey, aiKey, requiredApprovals: null, statusDescription: `Unknown label combination: risk:${riskKey}, ai:${aiKey}.` };
+  }
+
+  return { riskKey, aiKey, requiredApprovals: ROUTING_TABLE[riskKey][aiKey], statusDescription: null };
+}
+
+// Count current APPROVED reviews, keeping only the most-recent review per reviewer.
+async function countApprovals({ github, context, prNumber }) {
+  const { data: reviews } = await github.rest.pulls.listReviews({
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    pull_number: prNumber,
+  });
+
+  const latestByReviewer = {};
+  for (const review of reviews) {
+    // Keep the latest review per user (reviews are returned in chronological order).
+    latestByReviewer[review.user.login] = review.state;
+  }
+
+  return Object.values(latestByReviewer).filter(s => s === 'APPROVED').length;
+}
+
+// Decide the commit status state/description from the routing decision and approval count.
+function computeStatus({ requiredApprovals, statusDescription, riskKey, aiKey, approvalCount }) {
+  if (requiredApprovals === null) {
+    return { state: 'pending', description: statusDescription };
+  }
+
+  if (requiredApprovals === 0) {
+    return { state: 'success', description: `risk:${riskKey} + ai:${aiKey} → auto-merge allowed (0 approvals required).` };
+  }
+
+  if (approvalCount >= requiredApprovals) {
+    return { state: 'success', description: `risk:${riskKey} + ai:${aiKey} → approved (${approvalCount}/${requiredApprovals}).` };
+  }
+
+  return { state: 'pending', description: `risk:${riskKey} + ai:${aiKey} → waiting for approvals (${approvalCount}/${requiredApprovals}).` };
+}
+
+module.exports = async ({ github, context, core }) => {
+  const pr = await resolvePr({ github, context, core });
+  if (!pr) {
+    return;
+  }
+  const { prNumber, headSha } = pr;
+
+  const { data: prData } = await github.rest.pulls.get({
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    pull_number: prNumber,
+  });
+
+  const labelNames = prData.labels.map(l => l.name);
+  core.info(`PR #${prNumber} labels: ${labelNames.join(', ') || '(none)'}`);
+
+  const { riskKey, aiKey, requiredApprovals, statusDescription } = getRoutingDecision(labelNames);
+
+  const approvalCount = await countApprovals({ github, context, prNumber });
+  core.info(`Approvals: ${approvalCount}`);
+
+  const { state, description } = computeStatus({ requiredApprovals, statusDescription, riskKey, aiKey, approvalCount });
+  core.info(`Setting status: ${state} — ${description}`);
+
+  // The context name MUST match the required status check name in branch protection.
+  await github.rest.repos.createCommitStatus({
+    owner: context.repo.owner,
+    repo: context.repo.repo,
+    sha: headSha,
+    state,
+    description,
+    context: 'layer4-gatekeeper',
+  });
+};
diff --git a/.husky/pre-push b/.husky/pre-push
new file mode 100755
index 000000000..056a93c0b
--- /dev/null
+++ b/.husky/pre-push
@@ -0,0 +1,5 @@
+. "$(dirname "$0")/common.sh"
+
+echo '>> Running Pushgate pre-push checks...'
+
+"$(git rev-parse --git-common-dir)/hooks/pre-push" "$@"
\ No newline at end of file
diff --git a/.pushgate.yml b/.pushgate.yml
new file mode 100644
index 000000000..882899176
--- /dev/null
+++ b/.pushgate.yml
@@ -0,0 +1,236 @@
+# =============================================================================
+# Pushgate v2 configuration - full reference
+# https://github.com/rootstrap/ai-pushgate
+# =============================================================================
+# Commit .pushgate.yml so the team shares review settings.
+#
+# To install or update Pushgate:
+#   curl -fsSL https://raw.githubusercontent.com/rootstrap/ai-pushgate/main/install.sh | bash
+#
+# Reinstall with a pre-built template when useful:
+#   curl -fsSL https://raw.githubusercontent.com/rootstrap/ai-pushgate/main/install.sh | bash -s -- --template node
+#   curl -fsSL https://raw.githubusercontent.com/rootstrap/ai-pushgate/main/install.sh | bash -s -- --template typescript
+#   curl -fsSL https://raw.githubusercontent.com/rootstrap/ai-pushgate/main/install.sh | bash -s -- --template nextjs
+#   curl -fsSL https://raw.githubusercontent.com/rootstrap/ai-pushgate/main/install.sh | bash -s -- --template ruby
+#   curl -fsSL https://raw.githubusercontent.com/rootstrap/ai-pushgate/main/install.sh | bash -s -- --template rails
+# =============================================================================
+
+version: 2
+
+ai:
+  # Supported modes: blocking, advisory, off.
+  mode: advisory
+
+  # Changed-line overages block the push; prompt-token overages skip local AI.
+  max_changed_lines: 700
+  max_prompt_tokens: 12000
+  timeout_seconds: 120
+
+  # Blocking and advisory modes select a provider and define its matching block.
+  provider: claude
+  providers:
+    # Provider-specific settings are kept below the provider name.
+    claude:
+      model: claude-sonnet-4-20250514
+    # To use the standalone GitHub Copilot CLI, set provider: copilot and
+    # uncomment this block. Omit model to let Copilot choose its default.
+    # copilot:
+    #   model: auto
+
+review:
+  # Branch to diff against when collecting changes.
+  target_branch: master
+
+  # Lines of surrounding context included in the diff sent to the provider.
+  context_lines: 10
+
+  # Below this changed-line threshold, later AI work can send full file context.
+  max_lines_for_full_file: 300
+
+# =============================================================================
+# Tools
+# =============================================================================
+# Tools run before AI review. Each command is an argv array, not a shell string.
+# A {changed_files} token expands to individual argv entries without shell
+# interpolation, so filenames with spaces stay one argument.
+#
+# Tool defaults:
+#   timeout_seconds: 60
+#   mode: blocking       # blocking | warning; warnings require confirmation
+#   run: changed_files   # changed_files | always
+#   fail_fast: true
+#
+# Examples (uncomment and adapt as needed):
+#
+# tools:
+#   - name: eslint
+#     command: ["npx", "eslint", "{changed_files}"]
+#     extensions: [".js", ".jsx", ".ts", ".tsx", ".mjs"]
+#     timeout_seconds: 60
+#     mode: blocking
+#     run: changed_files
+#     fail_fast: true
+#
+#   - name: prettier
+#     command: ["npx", "prettier", "--check", "{changed_files}"]
+#     extensions: [".js", ".jsx", ".ts", ".tsx", ".mjs", ".json", ".css", ".md"]
+#
+#   - name: rubocop
+#     command: ["bundle", "exec", "rubocop", "{changed_files}"]
+#     extensions: [".rb", ".rake", ".gemspec"]
+#
+#   - name: brakeman
+#     command: ["bundle", "exec", "brakeman", "--no-pager"]
+#     run: always
+#
+#   - name: pytest
+#     command: ["pytest", "--tb=short"]
+#     extensions: [".py"]
+#
+tools:
+  - name: type-check
+    command:
+      - pnpm
+      - run
+      - type-check
+    run: always
+    timeout_seconds: 120
+    mode: blocking
+    fail_fast: false
+
+  - name: eslint
+    command:
+      - pnpm
+      - exec
+      - eslint
+      - '{changed_files}'
+    extensions:
+      - .js
+      - .jsx
+      - .ts
+      - .tsx
+      - .mjs
+    run: changed_files
+    timeout_seconds: 120
+    mode: blocking
+    fail_fast: false
+
+  - name: lint
+    command:
+      - pnpm
+      - run
+      - lint
+    run: always
+    timeout_seconds: 120
+    mode: blocking
+    fail_fast: false
+
+  - name: lint-translations
+    command:
+      - pnpm
+      - run
+      - lint:translations
+    run: always
+    timeout_seconds: 120
+    mode: blocking
+    fail_fast: false
+
+  - name: test
+    command:
+      - pnpm
+      - run
+      - test
+    run: always
+    timeout_seconds: 120
+    mode: blocking
+    fail_fast: false
+
+  - name: checks-complete
+    command:
+      - bash
+      - -lc
+      - echo Pushgate checks finished
+    run: always
+    timeout_seconds: 10
+    mode: blocking
+    fail_fast: true
+
+# =============================================================================
+# Built-in deterministic policies
+# =============================================================================
+# Built-ins are opt-in local checks that do not require external tools.
+#
+# Policy defaults:
+#   mode: blocking       # blocking | warning; warnings require confirmation
+#
+# Examples (uncomment and adapt as needed):
+#
+# policies:
+#   diff_size:
+#     max_changed_lines: 500
+#     mode: warning      # asks before continuing
+#     fail_fast: false   # if blocking, continue later checks after a violation
+#
+#   forbidden_paths:
+#     patterns:
+#       - ".env"
+#       - ".env.*"
+#       - "secrets/**"
+#       - "*.pem"
+#     mode: blocking
+#     fail_fast: true
+#
+policies:
+  diff_size:
+    max_changed_lines: 700
+    mode: warning
+    fail_fast: false
+
+  forbidden_paths:
+    patterns:
+      - .env
+      - .env.*
+      - secrets/**
+      - '*.pem'
+    mode: blocking
+    fail_fast: false
+
+# =============================================================================
+# Plugins
+# =============================================================================
+# Plugin adapters run external scanners through a first-class Pushgate result
+# model. They run after built-in policies and before generic tools.
+#
+# Gitleaks scans the branch commit range for secrets before push. Install it
+# separately (for example, brew install gitleaks) and tune rules with
+# .gitleaks.toml, .gitleaksignore, or a baseline report.
+#
+# plugins:
+#   gitleaks:
+#     enabled: true
+#     command: gitleaks
+#     timeout_seconds: 60
+#     mode: blocking
+#     fail_fast: true
+#     config_path: .gitleaks.toml
+#     baseline_path: .gitleaks/baseline.json
+#     gitleaks_ignore_path: .gitleaksignore
+#
+plugins: {}
+
+# =============================================================================
+# Ignore paths
+# =============================================================================
+# Files and patterns excluded from tool checks and AI review.
+ignore_paths:
+  - '*.lock'
+  - package-lock.json
+  - pnpm-lock.yaml
+  - yarn.lock
+  - Gemfile.lock
+  - dist/**
+  - build/**
+  - .next/**
+  - coverage/**
+  - tmp/**
+  - log/**
diff --git a/README-project.md b/README-project.md
index becde97db..1d59bf24d 100644
--- a/README-project.md
+++ b/README-project.md
@@ -59,6 +59,47 @@ To build your app locally you can run any of the build scripts with --local.
 
 `pnpm build:development:ios --local`
 
+## Pushgate
+
+This repository uses `ai-pushgate` from `.git/hooks/pre-push` to run local checks before `git push`.
+
+Pushgate setup for template users:
+- `.pushgate.yml` is versioned, so everyone gets the same rules.
+- `.git/hooks/pre-push` is local and is not committed to Git.
+- If you create the app with `create-rootstrap-rn-app`, Pushgate is installed automatically during setup.
+- For existing clones, or if the hook is missing, install it manually:
+
+Install from repo root:
+```sh
+curl -fsSL https://raw.githubusercontent.com/rootstrap/ai-pushgate/main/install.sh | bash
+```
+
+Verify the hook was created:
+```sh
+ls .git/hooks/pre-push
+```
+
+How to skip checks:
+> Skip AI only: `git -c pushgate.skip-ai-check=true push`
+> Skip everything: `git push --no-verify`
+
+## PR Risk Classification
+
+This repository uses a simple `risk:*` label system when opening pull requests.
+
+| Label | When to use |
+| --- | --- |
+| `risk:low` | Config, copy, minor UI tweaks with low blast radius. |
+| `risk:medium` | Feature work and refactors touching multiple files. |
+| `risk:high` | Auth, payments, migrations, and security-sensitive code. |
+
+Before requesting review, apply the label that best matches the change. When in doubt, escalate instead of guessing.
+
+Setup checklist:
+- Create `risk:low`, `risk:medium`, and `risk:high` labels in the repo.
+- Keep the risk criteria documented in the PR template or contributing guide.
+- Define who can override or escalate the label, such as the tech lead.
+
 ### SonarQube setup
 
 SonarQube is an open-source platform for continuous inspection of code quality. It performs automatic reviews to detect bugs, code smells, and security vulnerabilities. Rootstrap has a SonarQube instance to improve the quality of the software we develop. On each PR, a GitHub Action is triggered to perform the analysis. To set up SonarQube correctly, you need to add the `SONAR_TOKEN`, `SONAR_URL`, and `SONAR_PROJECT` secrets to the repository. Additionally, you must select the quality gate named `ReactNativeTemplate` for your project on SonarQube. In case you're using this project outside Rootstrap and you're not planning to use SonarQube the sonar scanner [workflow](.github/workflows/sonar.yml) should be deleted.
diff --git a/README.md b/README.md
index a93fddb37..d187e400f 100644
--- a/README.md
+++ b/README.md
@@ -92,6 +92,47 @@ The bot will be triggered on issues, pull requests and comments, you can modify
 
 Check this [file](https://github.com/rootstrap/rs-gpt-review/blob/main/.github/workflows/main.yml) for more examples.
 
+## PR Risk Classification
+
+This repository uses a simple `risk:*` label system when opening pull requests.
+
+| Label | When to use |
+| --- | --- |
+| `risk:low` | Config, copy, minor UI tweaks with low blast radius. |
+| `risk:medium` | Feature work and refactors touching multiple files. |
+| `risk:high` | Auth, payments, migrations, and security-sensitive code. |
+
+Before requesting review, apply the label that best matches the change. When in doubt, escalate instead of guessing.
+
+Setup checklist:
+- Create `risk:low`, `risk:medium`, and `risk:high` labels in the repo.
+- Keep the risk criteria documented in the PR template or contributing guide.
+- Define who can override or escalate the label, such as the tech lead.
+
+## Pushgate
+
+This repository uses `ai-pushgate` from `.git/hooks/pre-push` to run local checks before `git push`.
+
+Pushgate setup for template users:
+- `.pushgate.yml` is versioned, so everyone gets the same rules.
+- `.git/hooks/pre-push` is local and is not committed to Git.
+- If you create the app with `create-rootstrap-rn-app`, Pushgate is installed automatically during setup.
+- For existing clones, or if the hook is missing, install it manually:
+
+Install from repo root:
+```sh
+curl -fsSL https://raw.githubusercontent.com/rootstrap/ai-pushgate/main/install.sh | bash
+```
+
+Verify the hook was created:
+```sh
+ls .git/hooks/pre-push
+```
+
+How to skip checks:
+> Skip AI only: `git -c pushgate.skip-ai-check=true push`
+> Skip everything: `git push --no-verify`
+
 <!-- add a gif image here  -->
 
 ## 💎 Libraries used
diff --git a/cli/index.js b/cli/index.js
index 2d3bd1d36..35f2bc4c0 100755
--- a/cli/index.js
+++ b/cli/index.js
@@ -3,7 +3,11 @@
 const { consola } = require('consola');
 const { showMoreDetails } = require('./utils.js');
 const { cloneLatestTemplateRelease } = require('./clone-repo.js');
-const { setupProject, installDependencies } = require('./setup-project.js');
+const {
+  setupProject,
+  installDependencies,
+  installPushgate,
+} = require('./setup-project.js');
 const pkg = require('./package.json');
 
 const { name: packageName } = pkg;
@@ -27,6 +31,9 @@ const createRootstrapApp = async () => {
   // install project dependencies using pnpm
   await installDependencies(projectName);
 
+  // install Pushgate hook (best-effort)
+  await installPushgate(projectName);
+
   // show instructions to run the project + link to the documentation
   showMoreDetails(projectName);
 };
diff --git a/cli/setup-project.js b/cli/setup-project.js
index cbde3776b..5cc0c70f0 100755
--- a/cli/setup-project.js
+++ b/cli/setup-project.js
@@ -1,8 +1,6 @@
 const {
   execShellCommand,
   runCommand,
-  UPSTREAM_REPOSITORY,
-  TEMPLATE_REPOSITORY,
 } = require('./utils.js');
 const { consola } = require('consola');
 const fs = require('fs-extra');
@@ -25,6 +23,20 @@ const installDependencies = async (projectName) => {
   });
 };
 
+const installPushgate = async (projectName) => {
+  consola.start('Installing Pushgate pre-push hook');
+  try {
+    await execShellCommand(
+      `cd ${projectName} && curl -fsSL https://raw.githubusercontent.com/rootstrap/ai-pushgate/main/install.sh | bash`
+    );
+    consola.success('Pushgate pre-push hook installed');
+  } catch (error) {
+    consola.warn(
+      'Could not auto-install Pushgate. Run installer manually from the project root.'
+    );
+  }
+};
+
 const removeUnrelatedFiles = () => {
   projectFilesManager.removeFiles([
     '.git',
@@ -227,4 +239,5 @@ const setupProject = async (projectName) => {
 module.exports = {
   setupProject,
   installDependencies,
+  installPushgate,
 };