diff --git a/AGENTS.md b/AGENTS.md
index 49309f9..4c23da9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -24,7 +24,8 @@ personal-dev organization: no required status check contexts and zero required
 approving reviews (see the comment in `gh-protections.tf`). PRs are used for CI
 validation, plan output, and change history, not as a review gate. Do not
 tighten `contexts` or `required_approving_review_count` unless explicitly
-requested.
+requested. The `admins` team may also force-push (`force_push_bypassers`) for
+history maintenance; all other force pushes remain blocked.
 
 GitHub silently drops branch-protection bypass actors that have no repository
 access at write time — the apply succeeds but the stored rule omits them, so
diff --git a/gh-protections.tf b/gh-protections.tf
index 55ca206..afb1df8 100644
--- a/gh-protections.tf
+++ b/gh-protections.tf
@@ -10,6 +10,7 @@ resource "github_branch_protection" "protections" {
   pattern                         = "main"
   enforce_admins                  = false
   allows_force_pushes             = false
+  force_push_bypassers            = ["${var.github_owner}/${github_team.admins.slug}"]
   required_linear_history         = true
   require_conversation_resolution = true
   required_status_checks {