diff --git a/hbs2-git3/lib/HBS2/Git3/Export.hs b/hbs2-git3/lib/HBS2/Git3/Export.hs
index bf9291f9..18a0e0a4 100644
--- a/hbs2-git3/lib/HBS2/Git3/Export.hs
+++ b/hbs2-git3/lib/HBS2/Git3/Export.hs
@@ -135,6 +135,8 @@ export mbh refs = withStateDo do
           reflog <- getGitRemoteKey
                         >>= orThrowUser "reflog not set"
 
+          gk' <- getGK
+
           lift $ fix \next -> atomically (readTBQueue hbs2Q) >>= \case
             Nothing -> none
             Just (fn,_) -> void $ flip runContT pure do
@@ -143,14 +145,16 @@ export mbh refs = withStateDo do
                 ts <- liftIO getPOSIXTime <&> round
                 lbs <- LBS.readFile fn
                 let meta = mempty
-                let gk = Nothing
 
                 exported <- readTVarIO _exported
                 debug $ red "EXPORTED" <+> pretty exported
 
+                let gkh = fst <$> gk'
+                let gk = snd <$> gk'
+
                 when (exported > 0) do
                   href <- createTreeWithMetadata sto gk meta lbs >>= orThrowPassIO
-                  writeLogEntry ("tree" <+> pretty ts <+> pretty href)
+                  writeLogEntry ("tree" <+> pretty ts <+> pretty href )
                   debug $ "SENDING" <+> pretty href <+> pretty fn
 
                   let payload = LBS.toStrict $ serialise (AnnotatedHashRef Nothing href)
diff --git a/hbs2-git3/lib/HBS2/Git3/Run.hs b/hbs2-git3/lib/HBS2/Git3/Run.hs
index 8f5580e7..62515a1d 100644
--- a/hbs2-git3/lib/HBS2/Git3/Run.hs
+++ b/hbs2-git3/lib/HBS2/Git3/Run.hs
@@ -14,6 +14,7 @@ import HBS2.Git3.State
 import HBS2.Git3.Repo qualified as Repo
 import HBS2.Git3.Repo
 import HBS2.Git3.Logger
+import HBS2.Net.Auth.GroupKeySymm
 
 import Data.Config.Suckless.Script
 import Data.Config.Suckless.Almost.RPC
@@ -440,6 +441,12 @@ compression      ;  prints compression level
           (p,_) <- getRepoRefLogCredentials
           liftIO $ print $ pretty $ mkForm @C "matched" [mkSym (show $ pretty ( AsBase58 p) )]
 
+        entry $ bindMatch "repo:gk" $ nil_ $ \syn -> lift $ connectedDo $ do
+          resolveRepoKeyThrow syn >>= setGitRepoKey
+          gk' <- getGK
+          for_ gk' $ \(gkh, _) -> do
+            liftIO $ print $ pretty $ mkForm @C "gk" [ mkSym (show $ pretty gkh) ]
+
         entry $ bindMatch "repo:init" $ nil_ $ \syn -> lift $ connectedDo do
             Repo.initRepo syn
 
diff --git a/hbs2-git3/lib/HBS2/Git3/State.hs b/hbs2-git3/lib/HBS2/Git3/State.hs
index dab4bc97..6be90ed8 100644
--- a/hbs2-git3/lib/HBS2/Git3/State.hs
+++ b/hbs2-git3/lib/HBS2/Git3/State.hs
@@ -15,6 +15,8 @@ import HBS2.Git3.State.Internal.RefLog as Exported
 import HBS2.Git3.State.Internal.Segment as Exported
 import HBS2.Git3.State.Internal.Index as Exported
 
+import HBS2.Net.Auth.GroupKeySymm
+
 import HBS2.Storage.Operations.Missed
 import HBS2.Net.Auth.Credentials
 import HBS2.KeyMan.Keys.Direct
@@ -44,6 +46,15 @@ import Codec.Compression.Zstd (maxCLevel)
 
 newtype RepoManifest = RepoManifest [Syntax C]
 
+-- FIXME: cache
+getGK :: forall m . HBS2GitPerks m => Git3 m (Maybe (HashRef, GroupKey 'Symm 'HBS2Basic))
+getGK = do
+  sto <- getStorage
+  mf <- getRepoManifest
+  runMaybeT do
+    gkh <- headMay [ x | ListVal [SymbolVal "gk", HashLike x ] <- coerce mf ] & toMPlus
+    gk <- loadGroupKeyMaybe sto gkh >>= toMPlus
+    pure (gkh,gk)
 
 getRefLog :: RepoManifest -> Maybe GitRemoteKey
 getRefLog mf = lastMay [ x