diff --git a/internal/mountsync/syncer.go b/internal/mountsync/syncer.go
index af5f6547..68683508 100644
--- a/internal/mountsync/syncer.go
+++ b/internal/mountsync/syncer.go
@@ -6784,7 +6784,15 @@ func (s *Syncer) pullRemoteFullGithubTarSeed(ctx context.Context, client githubW
 			PathPrefix:    s.githubWorkingTree.ContentsRoot,
 			HeadSHA:       headSHA,
 			SourceProfile: manifest.SourceProfile,
-			Gzip:          true,
+			// Raw tar, not gzip: the flag only affects server-generated
+			// tars — the retained source archive is served from R2 either
+			// way. A gzipped generated tar is held to the server's 128 MiB
+			// buffered ceiling, so any repo past that size 413s on the
+			// merged/base-snapshot paths (including the ACL deny
+			// fall-through) and drops to per-file pulls. Raw tar gets the
+			// multi-GiB streaming ceiling and skips the CompressionStream
+			// CPU the ceiling exists to protect.
+			Gzip:          false,
 			SourceArchive: true,
 		})
 	})
diff --git a/internal/mountsync/syncer_test.go b/internal/mountsync/syncer_test.go
index b682d8ff..41d098aa 100644
--- a/internal/mountsync/syncer_test.go
+++ b/internal/mountsync/syncer_test.go
@@ -3107,8 +3107,8 @@ func TestPullRemoteFullGithubWorkingTreeTarSeedsAndStoresCursor(t *testing.T) {
 	if client.lastTarSeed.SourceProfile != "complete-v1" {
 		t.Fatalf("expected complete source profile on tar export, got %q", client.lastTarSeed.SourceProfile)
 	}
-	if !client.lastTarSeed.SourceArchive || !client.lastTarSeed.Gzip {
-		t.Fatalf("expected native gzip source archive request, got %+v", client.lastTarSeed)
+	if !client.lastTarSeed.SourceArchive || client.lastTarSeed.Gzip {
+		t.Fatalf("expected source archive request with raw (gzip=0) generated tar, got %+v", client.lastTarSeed)
 	}
 	gotReadme, err := os.ReadFile(filepath.Join(localDir, "README.md"))
 	if err != nil {