diff --git a/plugins/git/functions b/plugins/git/functions
index 9c9b9206c..ea1a06bb7 100755
--- a/plugins/git/functions
+++ b/plugins/git/functions
@@ -56,6 +56,17 @@ git_trigger_build() {
   dokku_receive "$APP" "$BUILDER" "$TMP_WORK_DIR"
 }
 
+fn-git-verify-app() {
+  declare desc="verifies an existing app, or validates the name of a new app"
+  declare APP="$1"
+
+  if [[ -d "$DOKKU_ROOT/$APP" ]]; then
+    verify_app_name "$APP"
+  else
+    is_valid_app_name "$APP"
+  fi
+}
+
 cmd-git-hook() {
   declare desc="kick off receive-app trigger from git prereceive hook"
   declare cmd="git-hook"
@@ -63,7 +74,7 @@ cmd-git-hook() {
   declare APP="$1"
   local DOKKU_DEPLOY_BRANCH
 
-  plugn trigger app-exists "$APP" 2>/dev/null || is_valid_app_name "$APP"
+  fn-git-verify-app "$APP"
 
   DOKKU_DEPLOY_BRANCH="$(fn-git-computed-deploy-branch "$APP")"
   if ! git check-ref-format --branch "$DOKKU_DEPLOY_BRANCH" &>/dev/null; then
@@ -154,7 +165,7 @@ cmd-git-upload-pack() {
   declare APP="$1"
 
   APP="$(echo "$APP" | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g' | sed 's/^\///g')"
-  is_valid_app_name "$APP"
+  fn-git-verify-app "$APP"
   ! plugn trigger app-exists "$APP" &>/dev/null && plugn trigger app-maybe-create "$APP"
 
   plugn trigger git-pre-pull "$APP"
@@ -168,7 +179,7 @@ cmd-git-glob() {
   local APP="$(echo "$2" | perl -pe 's/(?<!\\)'\''//g' | sed 's/\\'\''/'\''/g' | sed 's/^\///g')"
   local APP_PATH=$DOKKU_ROOT/$APP
 
-  plugn trigger app-exists "$APP" 2>/dev/null || is_valid_app_name "$APP"
+  fn-git-verify-app "$APP"
   if [[ $1 == "git-receive-pack" && ! -d "$APP_PATH/refs" ]]; then
     ! plugn trigger app-exists "$APP" &>/dev/null && plugn trigger app-maybe-create "$APP"
 
diff --git a/tests/unit/git_8.bats b/tests/unit/git_8.bats
new file mode 100644
index 000000000..ce5bf2c93
--- /dev/null
+++ b/tests/unit/git_8.bats
@@ -0,0 +1,93 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+APP_FILTER_PLUGIN_NAME="app-filter-test"
+
+setup() {
+  global_setup
+  create_app
+}
+
+teardown() {
+  rm -rf "${PLUGIN_ENABLED_PATH:?}/$APP_FILTER_PLUGIN_NAME" "${PLUGIN_AVAILABLE_PATH:?}/$APP_FILTER_PLUGIN_NAME"
+  rm -rf /tmp/hidden-app-clone
+  destroy_app
+  global_teardown
+}
+
+@test "(git) push to filtered app" {
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  setup_app_filter_plugin "$TEST_APP"
+
+  run /bin/bash -c "dokku apps:exists $TEST_APP"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+
+  run /bin/bash -c "cd /tmp && rm -rf hidden-app-clone && cp -r $BATS_TEST_DIRNAME/../../tests/apps/python hidden-app-clone && cd hidden-app-clone && git init -q && git add . && git -c user.email=robot@example.com -c user.name=Robot commit -qm second && git push -f dokku@$DOKKU_DOMAIN:$TEST_APP HEAD:master"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App $TEST_APP does not exist"
+  assert_output_not_contains "pre-receive hook declined"
+}
+
+@test "(git) clone of filtered app" {
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  setup_app_filter_plugin "$TEST_APP"
+
+  run /bin/bash -c "git clone dokku@$DOKKU_DOMAIN:$TEST_APP /tmp/hidden-app-clone"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App $TEST_APP does not exist"
+}
+
+@test "(git) archive of filtered app" {
+  run deploy_app
+  echo "output: $output"
+  echo "status: $status"
+  assert_success
+
+  setup_app_filter_plugin "$TEST_APP"
+
+  run /bin/bash -c "set -o pipefail; git archive --remote=dokku@$DOKKU_DOMAIN:$TEST_APP master | tar -t"
+  echo "output: $output"
+  echo "status: $status"
+  assert_failure
+  assert_output_contains "App $TEST_APP does not exist"
+}
+
+setup_app_filter_plugin() {
+  declare desc="installs a plugin that filters out a single app"
+  declare FILTERED_APP="$1"
+  local PLUGIN_DIR="$PLUGIN_AVAILABLE_PATH/$APP_FILTER_PLUGIN_NAME"
+  mkdir -p "$PLUGIN_DIR"
+
+  cat <<EOF >"$PLUGIN_DIR/plugin.toml"
+[plugin]
+description = "test plugin filtering out a single app"
+version = "0.1.0"
+[plugin.config]
+EOF
+
+  cat <<EOF >"$PLUGIN_DIR/user-auth-app"
+#!/usr/bin/env bash
+shift 2
+for app in "\$@"; do
+  [[ "\$app" == "$FILTERED_APP" ]] || echo "\$app"
+done
+EOF
+  chmod +x "$PLUGIN_DIR/user-auth-app"
+
+  dokku plugin:enable "$APP_FILTER_PLUGIN_NAME"
+}