diff --git a/.gitattributes b/.gitattributes
index 32c5da94a..46acac016 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1 @@
-*.h filter=commit_hash
+commit_hash.h filter=commit_hash
diff --git a/scripts/project/git-filter-clean-pEpEngine-commit-hash.sh b/scripts/git/git-filter-clean-pEpEngine-commit-hash.sh
similarity index 96%
rename from scripts/project/git-filter-clean-pEpEngine-commit-hash.sh
rename to scripts/git/git-filter-clean-pEpEngine-commit-hash.sh
index 4ccaf1a6a..663506366 100755
--- a/scripts/project/git-filter-clean-pEpEngine-commit-hash.sh
+++ b/scripts/git/git-filter-clean-pEpEngine-commit-hash.sh
@@ -10,7 +10,6 @@ else
     SED="sed -i"
 fi
 
-echo "FILE is $1"
 echo "Replacing PEP_CURRENT_COMMIT_HASH value in src/commit_hash.h with DUMMY_COMMIT_HASH_ERROR. See you next checkout or after the commit!"
 
 $($SED "s/\(PEP_CURRENT_COMMIT_HASH=\).*/\1\DUMMY_COMMIT_HASH_ERROR\"/" $1)
@@ -18,4 +17,4 @@ $($SED "s/\(PEP_CURRENT_COMMIT_HASH=\).*/\1\DUMMY_COMMIT_HASH_ERROR\"/" $1)
 # Honestly, I have no idea what git is doing with the stupid empty '' for sed, but I give up. It makes a commit_hash.h'' backup for no reason. So we eat it.
 if [[ "$OSTYPE" == "darwin"* ]]; then
     rm $1"'""'"
-else
+fi
diff --git a/scripts/project/post-checkout b/scripts/git/post-checkout
similarity index 100%
rename from scripts/project/post-checkout
rename to scripts/git/post-checkout
diff --git a/scripts/git/post-commit b/scripts/git/post-commit
new file mode 100755
index 000000000..28ac70893
--- /dev/null
+++ b/scripts/git/post-commit
@@ -0,0 +1,25 @@
+#! /bin/sh
+
+#
+# Pseudo-smudge file for pEpEngine's commit-hash header
+#
+
+if [[ "$OSTYPE" == "darwin"* ]]; then
+    SED='sed -i '"'""'" 
+else
+    SED="sed -i"
+fi
+
+
+if test -f "src/commit_hash.h"; then
+    commit_hash="$(git rev-parse HEAD)"
+    echo "Replacing PEP_CURRENT_COMMIT_HASH value in src/commit_hash.h with current HEAD commit hash, $commit_hash. Will clean on commit or checkout."
+
+    $($SED "s/\(PEP_CURRENT_COMMIT_HASH=\).*/\1\"$commit_hash\"/" src/commit_hash.h)
+
+    # Whatever. You win, MacOS. You win.
+    if [[ "$OSTYPE" == "darwin"* ]]; then
+        rm src/commit_hash.h"'""'"
+    fi
+fi
+
diff --git a/scripts/git/post-merge-commit b/scripts/git/post-merge-commit
new file mode 100755
index 000000000..e69de29bb
diff --git a/scripts/git/pre-commit b/scripts/git/pre-commit
new file mode 100755
index 000000000..9e036b200
--- /dev/null
+++ b/scripts/git/pre-commit
@@ -0,0 +1,11 @@
+#! /bin/sh
+
+grep "DUMMY_COMMIT_HASH_ERROR" src/commit_hash.h 1>/dev/null
+if [ $? -eq 1 ]; then
+    staged_files=$(git diff-index --cached HEAD)
+    if [[ $staged_files == *commit_hash.h* ]]; then
+        echo "ERROR: You are checking in a modified src/commit_hash.h file which contains an unauthorised commit hash value - you shouldn't be. Please unstage it." >&2
+        echo "(Hint: git restore --staged src/commit_hash.h)"
+        exit 1
+    fi
+fi
diff --git a/scripts/project/git-filter-smudge-pEpEngine-commit-hash.sh b/scripts/project/git-filter-smudge-pEpEngine-commit-hash.sh
deleted file mode 100755
index c0e9e2df8..000000000
--- a/scripts/project/git-filter-smudge-pEpEngine-commit-hash.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#! /bin/sh
-
-echo "HELLO????" >&2
-
-#
-# Smudge file for pEpEngine's commit-hash header
-#
-
-if [[ "$OSTYPE" == "darwin"* ]]; then
-    SED="sed -i ''"
-else
-    SED="sed -i"
-fi
-
-commit_hash="$(git rev-parse HEAD)"
-echo "Replacing PEP_CURRENT_COMMIT_HASH value in src/commit_hash.h with current HEAD commit hash, $commit_hash. Will clean on commit or checkout."
-
-$($SED "s/\(PEP_CURRENT_COMMIT_HASH=\).*/\1\"$commit_hash\"/" $1)
-