diff --git a/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive b/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
index cca5de8..3827527 100755
--- a/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
+++ b/server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive
@@ -8,11 +8,26 @@ repo_dir=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd -P)
 cd "$repo_dir"
 owner_uid=$(id -u)
 
-find "$repo_dir/objects" "$repo_dir/refs" -user "$owner_uid" -type d -exec chmod g+rwx {} +
-find "$repo_dir/objects" "$repo_dir/refs" -user "$owner_uid" -type f -exec chmod g+rw {} +
+share_tree() {
+  find "$1" -user "$owner_uid" -type d -exec chmod g+rwx {} +
+  find "$1" -user "$owner_uid" -type f -exec chmod g+rw {} +
+}
+
+share_tree "$repo_dir/objects"
+share_tree "$repo_dir/refs"
+
+# receive-pack may keep new objects in a quarantine directory until hooks have
+# completed. Normalize that directory before Git moves the objects into place.
+if [ -n "${GIT_OBJECT_DIRECTORY:-}" ] && [ -d "$GIT_OBJECT_DIRECTORY" ]; then
+  case "$GIT_OBJECT_DIRECTORY/" in
+    "$repo_dir/"*) share_tree "$GIT_OBJECT_DIRECTORY" ;;
+  esac
+fi
 
 for shared_file in HEAD packed-refs; do
   if [ -f "$repo_dir/$shared_file" ]; then
     find "$repo_dir/$shared_file" -user "$owner_uid" -exec chmod g+rw {} +
   fi
 done
+
+printf '%s\n' "post_receive_permissions_reconciled" >"$repo_dir/hooks/post-receive.last"