diff --git a/dsh/tests/run.sh b/dsh/tests/run.sh
index 9254d17..c6ac70b 100755
--- a/dsh/tests/run.sh
+++ b/dsh/tests/run.sh
@@ -4,6 +4,25 @@ set -euo pipefail
 root="$(cd "$(dirname "$0")/../.." && pwd)"
 cd "$root"
 
+# `core.symlinks=false` checkouts materialize the tracked `dsh/bundle/hooks`
+# symlink as a regular file containing "../../hooks". Repair it before the
+# tests, otherwise five guard tests fail with BLOCKED instead of testing.
+ensure_bundle_hooks() {
+  local link="$root/dsh/bundle/hooks"
+  [ -L "$link" ] && return 0            # symlink (or a repaired one)
+  [ -d "$link" ] && return 0            # published bundle: a real copy of hooks/
+  if [ -f "$link" ] && [ "$(cat "$link")" = "../../hooks" ]; then
+    rm -f "$link"
+    ln -s ../../hooks "$link"
+    echo "repaired dsh/bundle/hooks -> ../../hooks (core.symlinks=false checkout)"
+    return 0
+  fi
+  echo "FAIL: dsh/bundle/hooks is neither a symlink to ../../hooks nor a copy of hooks/" >&2
+  exit 2
+}
+
+ensure_bundle_hooks
+
 for f in dsh/bundle/index.js dsh/bundle/command-role.js dsh/bundle/lib/*.js dsh/tests/*.mjs; do
   node --check "$f"
 done