diff --git a/pkg/registry/apis/provisioning/jobs/export/worker.go b/pkg/registry/apis/provisioning/jobs/export/worker.go
index cbfa84711bb..326502c221a 100644
--- a/pkg/registry/apis/provisioning/jobs/export/worker.go
+++ b/pkg/registry/apis/provisioning/jobs/export/worker.go
@@ -78,12 +78,10 @@ func (r *ExportWorker) Process(ctx context.Context, repo repository.Repository,
 		}
 
 		// New empty branch (same on main???)
-		if options.Branch != "" {
-			progress.SetMessage("create empty branch")
-			_, err := buffered.NewEmptyBranch(ctx, options.Branch)
-			if err != nil {
-				return fmt.Errorf("unable to create empty branch: %w", err)
-			}
+		progress.SetMessage("create empty branch")
+		_, err := buffered.CheckoutEmptyBranch(ctx, options.Branch) // or
+		if err != nil {
+			return fmt.Errorf("unable to create empty branch: %w", err)
 		}
 
 		repo = buffered     // send all writes to the buffered repo
diff --git a/pkg/registry/apis/provisioning/jobs/progress.go b/pkg/registry/apis/provisioning/jobs/progress.go
index 414a8054271..8533457c2e5 100644
--- a/pkg/registry/apis/provisioning/jobs/progress.go
+++ b/pkg/registry/apis/provisioning/jobs/progress.go
@@ -141,6 +141,9 @@ func (r *jobProgressRecorder) updateSummary(result JobResourceResult) {
 			summary.Create++
 		case repository.FileActionIgnored:
 			summary.Noop++
+		case repository.FileActionRenamed:
+			summary.Delete++
+			summary.Create++
 		}
 		summary.Write = summary.Create + summary.Update
 	}
diff --git a/pkg/registry/apis/provisioning/repository/go-git/wrapper.go b/pkg/registry/apis/provisioning/repository/go-git/wrapper.go
index 9c541be6fbe..d21686d4e47 100644
--- a/pkg/registry/apis/provisioning/repository/go-git/wrapper.go
+++ b/pkg/registry/apis/provisioning/repository/go-git/wrapper.go
@@ -57,11 +57,14 @@ func Clone(
 	if gitcfg == nil {
 		return nil, fmt.Errorf("missing github config")
 	}
+	if gitcfg.Branch == "" {
+		return nil, fmt.Errorf("missing base branch")
+	}
 	if opts.Root == "" {
 		return nil, fmt.Errorf("missing root config")
 	}
 
-	decrypted, err := secrets.Decrypt(ctx, []byte(gitcfg.EncryptedToken))
+	decrypted, err := secrets.Decrypt(ctx, gitcfg.EncryptedToken)
 	if err != nil {
 		return nil, fmt.Errorf("error decrypting token: %w", err)
 	}
@@ -87,9 +90,8 @@ func Clone(
 				Username: "grafana",         // this can be anything except an empty string for PAT
 				Password: string(decrypted), // TODO... will need to get from a service!
 			},
-			URL:           url,
-			ReferenceName: plumbing.ReferenceName(gitcfg.Branch),
-			Progress:      progress,
+			URL:      url,
+			Progress: progress,
 		})
 		if err != nil {
 			return nil, fmt.Errorf("clone error %w", err)
@@ -114,9 +116,11 @@ func Clone(
 		return nil, err
 	}
 
+	// Checkout the selected branch
 	err = worktree.Checkout(&git.CheckoutOptions{
 		Branch: plumbing.NewBranchReferenceName(gitcfg.Branch),
 		Force:  true, // clear any local changes
+		Create: true, // if not exists?
 	})
 	if err != nil {
 		return nil, fmt.Errorf("unable to open branch %w", err)
@@ -143,14 +147,16 @@ func mkdirTempClone(root string, config *provisioning.Repository) (string, error
 }
 
 // Remove everything from the tree
-func (g *GoGitRepo) NewEmptyBranch(ctx context.Context, branch string) (int64, error) {
-	err := g.tree.Checkout(&git.CheckoutOptions{
-		Branch: plumbing.NewBranchReferenceName(branch),
-		Force:  true, // clear any local changes
-		Create: true,
-	})
-	if err != nil {
-		return 0, err
+func (g *GoGitRepo) CheckoutEmptyBranch(ctx context.Context, branch string) (int64, error) {
+	if branch != "" {
+		err := g.tree.Checkout(&git.CheckoutOptions{
+			Branch: plumbing.NewBranchReferenceName(branch),
+			Force:  true, // clear any local changes
+			Create: true,
+		})
+		if err != nil {
+			return 0, err
+		}
 	}
 
 	count := int64(0)
@@ -179,6 +185,7 @@ func (g *GoGitRepo) Push(ctx context.Context, progress io.Writer) error {
 
 	return g.repo.PushContext(ctx, &git.PushOptions{
 		Progress: progress,
+		Force:    true, // avoid fast-forward-errors
 		Auth: &githttp.BasicAuth{ // reuse logic from clone?
 			Username: "grafana",
 			Password: g.decryptedPassword,
diff --git a/pkg/registry/apis/provisioning/repository/go-git/wrapper_test.go b/pkg/registry/apis/provisioning/repository/go-git/wrapper_test.go
index e6d6fc05e66..e2f282e7206 100644
--- a/pkg/registry/apis/provisioning/repository/go-git/wrapper_test.go
+++ b/pkg/registry/apis/provisioning/repository/go-git/wrapper_test.go
@@ -15,13 +15,29 @@ import (
 	"github.com/grafana/grafana/pkg/registry/apis/provisioning/repository"
 )
 
+type dummySecret struct{}
+
+// Decrypt implements secrets.Service.
+func (d *dummySecret) Decrypt(ctx context.Context, data []byte) ([]byte, error) {
+	token, ok := os.LookupEnv("gitwraptoken")
+	if !ok {
+		return nil, fmt.Errorf("missing token in environment")
+	}
+	return []byte(token), nil
+}
+
+// Encrypt implements secrets.Service.
+func (d *dummySecret) Encrypt(ctx context.Context, data []byte) ([]byte, error) {
+	panic("unimplemented")
+}
+
 // FIXME!! NOTE!!!!!
 // This is really just a sketchpad while trying to get things working
 // the test makes destructive changes to a real git repository :)
 // this should be removed before committing to main (likely sooner)
 // and replaced with integration tests that check the more specific results
 func TestGoGitWrapper(t *testing.T) {
-	token, ok := os.LookupEnv("gitwraptoken")
+	_, ok := os.LookupEnv("gitwraptoken")
 	if !ok {
 		t.Skipf("no token found in environment")
 	}
@@ -35,8 +51,7 @@ func TestGoGitWrapper(t *testing.T) {
 		Spec: v0alpha1.RepositorySpec{
 			GitHub: &v0alpha1.GitHubRepositoryConfig{
 				URL:    "https://github.com/grafana/git-ui-sync-demo",
-				Branch: "ryan-test",
-				Token:  token,
+				Branch: "ryan-test-test-test",
 			},
 		},
 	},
@@ -45,7 +60,7 @@ func TestGoGitWrapper(t *testing.T) {
 			// one commit (not 11)
 			SingleCommitBeforePush: true,
 		},
-		nil, // TODO: add a mock
+		&dummySecret{},
 		os.Stdout)
 	require.NoError(t, err)
 
@@ -57,9 +72,9 @@ func TestGoGitWrapper(t *testing.T) {
 
 	fmt.Printf("TREE:%s\n", string(jj))
 
-	branch := fmt.Sprintf("unit-test-%s", time.Now().Format("20060102-150405")) // the branch name to create
+	branch := "" //fmt.Sprintf("unit-test-%s", time.Now().Format("20060102-150405")) // the branch name to create
 
-	count, err := wrap.NewEmptyBranch(ctx, branch)
+	count, err := wrap.CheckoutEmptyBranch(ctx, branch)
 	require.NoError(t, err)
 	fmt.Printf("REMOVED: %d\n", count)