@@ -1,8 +1,12 @@
 package githttp
 
 import (
+	"bufio"
+	"bytes"
 	"context"
+	"errors"
 	"fmt"
+	"io"
 	"log/slog"
 	"net/url"
 	"path"
@@ -15,6 +19,7 @@ import (
 	"gitlab.com/gitlab-org/gitlab-shell/v14/internal/config"
 	"gitlab.com/gitlab-org/gitlab-shell/v14/internal/gitlabnet/accessverifier"
 	"gitlab.com/gitlab-org/gitlab-shell/v14/internal/gitlabnet/git"
+	"gitlab.com/gitlab-org/gitlab-shell/v14/internal/pktline"
 )
 
 // CellsPullCommand handles git pull (upload-pack) via SSH-over-HTTP for Cells
@@ -28,7 +33,8 @@ type CellsPullCommand struct {
 	Response   *accessverifier.Response
 }
 
-// Execute runs a Cells SSH-over-HTTP upload-pack request.
+// Execute runs a Cells SSH-over-HTTP upload-pack request. Upload-pack is
+// client-speaks-first, so pull can use a single request.
 func (c *CellsPullCommand) Execute(ctx context.Context) error {
 	log.FromContext(ctx).InfoContext(ctx, "Cells: using SSH-over-HTTP upload-pack",
 		slog.String("cell_address", c.Response.CellAddress))
@@ -62,7 +68,8 @@ type CellsPushCommand struct {
 	Response   *accessverifier.Response
 }
 
-// Execute runs a Cells SSH-over-HTTP receive-pack request.
+// Execute runs a Cells SSH-over-HTTP receive-pack request. Receive-pack is
+// server-speaks-first, so push must advertise before waiting for SSH input.
 func (c *CellsPushCommand) Execute(ctx context.Context) error {
 	log.FromContext(ctx).InfoContext(ctx, "Cells: using SSH-over-HTTP receive-pack",
 		slog.String("cell_address", c.Response.CellAddress))
@@ -72,7 +79,93 @@ func (c *CellsPushCommand) Execute(ctx context.Context) error {
 		return err
 	}
 
-	return executeSSHRequest(ctx, gitClient.SSHReceivePack, c.ReadWriter)
+	if advertisementErr := c.forwardAdvertisement(ctx, gitClient); advertisementErr != nil {
+		return fmt.Errorf("cells routing: receive-pack advertisement: %w", advertisementErr)
+	}
+
+	return c.forwardPush(ctx, gitClient)
+}
+
+func (c *CellsPushCommand) forwardPush(ctx context.Context, gitClient *git.Client) error {
+	clientInput, err := c.waitForPushInput(ctx)
+	if err != nil {
+		return err
+	}
+	if clientInput == nil {
+		return nil
+	}
+
+	return c.forwardReceivePack(ctx, gitClient, clientInput)
+}
+
+func (c *CellsPushCommand) waitForPushInput(ctx context.Context) (*bufio.Reader, error) {
+	clientInput := bufio.NewReader(c.ReadWriter.In)
+	// Open the streaming request once the client begins sending. The Cell's
+	// receive-pack validates command and pack framing.
+	_, err := clientInput.Peek(1)
+	if err == nil {
+		return clientInput, nil
+	}
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+	if errors.Is(err, io.EOF) {
+		return nil, nil
+	}
+
+	return nil, fmt.Errorf("cells routing: waiting for receive-pack input: %w", err)
+}
+
+func (c *CellsPushCommand) forwardReceivePack(ctx context.Context, gitClient *git.Client, clientInput io.Reader) error {
+	response, err := gitClient.SSHReceivePack(ctx, clientInput)
+	if err != nil {
+		return fmt.Errorf("cells routing: receive-pack response: %w", err)
+	}
+	defer response.Body.Close() //nolint:errcheck
+
+	if err := copyAdvertisement(io.Discard, response.Body); err != nil {
+		return fmt.Errorf("cells routing: receive-pack response advertisement: %w", err)
+	}
+
+	if _, err := io.Copy(c.ReadWriter.Out, response.Body); err != nil {
+		return fmt.Errorf("cells routing: receive-pack response: %w", err)
+	}
+
+	return nil
+}
+
+func (c *CellsPushCommand) forwardAdvertisement(ctx context.Context, gitClient *git.Client) error {
+	// A 0000 body makes command-less receive-pack exit cleanly after advertising;
+	// an empty body appends fatal output and Internal Server Error instead.
+	response, err := gitClient.SSHReceivePack(ctx, bytes.NewReader(pktline.PktFlush()))
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close() //nolint:errcheck
+
+	return copyAdvertisement(c.ReadWriter.Out, response.Body)
+}
+
+// copyAdvertisement leaves response bytes after the terminating flush unread.
+func copyAdvertisement(w io.Writer, r io.Reader) error {
+	for {
+		packet, err := pktline.ReadPacket(r)
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return fmt.Errorf("advertisement ended before flush: %w", err)
+			}
+
+			return err
+		}
+
+		if _, err := w.Write(packet); err != nil {
+			return err
+		}
+
+		if pktline.IsFlush(packet) {
+			return nil
+		}
+	}
 }
 
 // NewCellsPushCommand builds a Cells SSH-over-HTTP receive-pack command.