diff --git a/scripts/gitops-render.mjs b/scripts/gitops-render.mjs
index 66b72b6f..15848b9e 100644
--- a/scripts/gitops-render.mjs
+++ b/scripts/gitops-render.mjs
@@ -3797,7 +3797,9 @@ function devopsInfraGitMirrorManifest(args, deploy) {
   const laneConfig = configObject(configObject(deploy.lanes, "deploy.lanes")[args.lane], `deploy.lanes.${args.lane}`);
   const gitMirrorConfig = configObject(laneConfig.gitMirror, `deploy.lanes.${args.lane}.gitMirror`);
   const gitMirrorProxy = configObject(gitMirrorConfig.egressProxy, `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  assert.equal(gitMirrorProxy.mode, "node-global", `deploy.lanes.${args.lane}.gitMirror.egressProxy.mode must be node-global`);
+  const gitMirrorProxyMode = requiredConfigString(gitMirrorProxy, "mode", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
+  assert.ok(gitMirrorProxyMode === "node-global" || gitMirrorProxyMode === "direct", `deploy.lanes.${args.lane}.gitMirror.egressProxy.mode must be node-global or direct`);
+  const useDirectGitMirrorProxy = gitMirrorProxyMode === "direct";
   const gitMirrorNamespace = requiredConfigString(gitMirrorConfig, "namespace", `deploy.lanes.${args.lane}.gitMirror`);
   const gitMirrorReadName = requiredConfigString(gitMirrorConfig, "serviceReadName", `deploy.lanes.${args.lane}.gitMirror`);
   const gitMirrorWriteName = requiredConfigString(gitMirrorConfig, "serviceWriteName", `deploy.lanes.${args.lane}.gitMirror`);
@@ -3806,16 +3808,29 @@ function devopsInfraGitMirrorManifest(args, deploy) {
   const gitMirrorCacheHostPath = optionalConfigString(gitMirrorConfig, "cacheHostPath", `deploy.lanes.${args.lane}.gitMirror`);
   const gitMirrorServicePort = requiredConfigPositiveInteger(gitMirrorConfig, "servicePort", `deploy.lanes.${args.lane}.gitMirror`);
   const gitMirrorConfigMapName = requiredConfigString(gitMirrorConfig, "syncConfigMapName", `deploy.lanes.${args.lane}.gitMirror`);
-  const proxyNamespace = requiredConfigString(gitMirrorProxy, "namespace", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  const proxyServiceName = requiredConfigString(gitMirrorProxy, "serviceName", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  const proxyPort = requiredConfigPositiveInteger(gitMirrorProxy, "port", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  const proxyClientName = requiredConfigString(gitMirrorProxy, "clientName", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
-  const proxyNoProxy = Array.isArray(gitMirrorProxy.noProxy) ? gitMirrorProxy.noProxy.filter((value) => typeof value === "string" && value.length > 0).join(",") : "";
+  const proxyNamespace = useDirectGitMirrorProxy ? "" : requiredConfigString(gitMirrorProxy, "namespace", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
+  const proxyServiceName = useDirectGitMirrorProxy ? "" : requiredConfigString(gitMirrorProxy, "serviceName", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
+  const proxyPort = useDirectGitMirrorProxy ? 0 : requiredConfigPositiveInteger(gitMirrorProxy, "port", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
+  const proxyClientName = useDirectGitMirrorProxy ? "" : requiredConfigString(gitMirrorProxy, "clientName", `deploy.lanes.${args.lane}.gitMirror.egressProxy`);
+  const proxyNoProxy = !useDirectGitMirrorProxy && Array.isArray(gitMirrorProxy.noProxy) ? gitMirrorProxy.noProxy.filter((value) => typeof value === "string" && value.length > 0).join(",") : "";
   const proxyHost = `${proxyServiceName}.${proxyNamespace}.svc.cluster.local`;
   const proxyUrl = `http://${proxyHost}:${proxyPort}`;
-  const proxySummary = `git-mirror-egress-proxy client=${proxyClientName} mode=node-global required=true host=${proxyHost} port=${proxyPort} ssh=GIT_SSH-wrapper source=yaml`;
-  const proxyCommand = `ProxyCommand=node /tmp/hwlab-github-proxy-connect.mjs ${proxyHost} ${proxyPort} %h %p`;
-  const gitMirrorSshPrelude = `printf '%s\\n' ${shellSingleQuote(proxySummary)} >&2
+  const proxySummary = useDirectGitMirrorProxy
+    ? "git-mirror-egress-proxy mode=direct required=false transport=ssh source=yaml"
+    : `git-mirror-egress-proxy client=${proxyClientName} mode=node-global required=true host=${proxyHost} port=${proxyPort} ssh=GIT_SSH-wrapper source=yaml`;
+  const proxyCommand = useDirectGitMirrorProxy ? "" : `ProxyCommand=node /tmp/hwlab-github-proxy-connect.mjs ${proxyHost} ${proxyPort} %h %p`;
+  const directGitMirrorSshPrelude = `printf '%s\\n' ${shellSingleQuote(proxySummary)} >&2
+cat > /tmp/hwlab-git-ssh-proxy.sh <<'SH_PROXY'
+#!/bin/sh
+exec ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.ssh/known_hosts -o ConnectTimeout=15 -o ServerAliveInterval=5 -o ServerAliveCountMax=1 "$@"
+SH_PROXY
+chmod 0700 /tmp/hwlab-git-ssh-proxy.sh
+unset HTTP_PROXY HTTPS_PROXY ALL_PROXY http_proxy https_proxy all_proxy
+export NO_PROXY='*'
+export no_proxy='*'
+export GIT_SSH=/tmp/hwlab-git-ssh-proxy.sh
+unset GIT_SSH_COMMAND`;
+  const proxiedGitMirrorSshPrelude = `printf '%s\\n' ${shellSingleQuote(proxySummary)} >&2
 cat > /tmp/hwlab-github-proxy-connect.mjs <<'NODE_PROXY'
 #!/usr/bin/env node
 import net from "node:net";
@@ -3882,6 +3897,7 @@ export NO_PROXY=${shellSingleQuote(proxyNoProxy)}
 export no_proxy=${shellSingleQuote(proxyNoProxy)}
 export GIT_SSH=/tmp/hwlab-git-ssh-proxy.sh
 unset GIT_SSH_COMMAND`;
+  const gitMirrorSshPrelude = useDirectGitMirrorProxy ? directGitMirrorSshPrelude : proxiedGitMirrorSshPrelude;
   const cacheVolume = gitMirrorCacheHostPath === null
     ? { name: "cache", persistentVolumeClaim: { claimName: gitMirrorCachePvcName } }
     : { name: "cache", hostPath: { path: gitMirrorCacheHostPath, type: "DirectoryOrCreate" } };