diff --git a/lib/Enterprise/RepositorySynchronizer.php b/lib/Enterprise/RepositorySynchronizer.php
index 4ca1160..9309cd5 100644
--- a/lib/Enterprise/RepositorySynchronizer.php
+++ b/lib/Enterprise/RepositorySynchronizer.php
@@ -598,7 +598,12 @@ HCL;
             $isReadme     = $basename === 'readme.md';
             $isChangelog  = in_array($basename, ['changelog.md', 'changelog'], true);
             $isProtected  = $isReadme || $isChangelog;
-            $canOverwrite = !$isProtected && ($force || $entry['always_overwrite']) && !($entry['protected'] ?? false);
+            // Protected files are NEVER overwritten, even with --force
+            if ($entry['protected'] ?? false) {
+                $summary['skipped'][] = ['file' => $targetPath, 'reason' => 'Protected — never overwritten'];
+                continue;
+            }
+            $canOverwrite = !$isProtected && ($force || $entry['always_overwrite']);
 
             if ($isReadme) {
                 $summary['skipped'][] = ['file' => $targetPath, 'reason' => 'README — never overwritten'];