diff --git a/decnet/web/router/swarm_updates/api_push_update.py b/decnet/web/router/swarm_updates/api_push_update.py
index 742bc3c..c913438 100644
--- a/decnet/web/router/swarm_updates/api_push_update.py
+++ b/decnet/web/router/swarm_updates/api_push_update.py
@@ -136,8 +136,12 @@ async def api_push_update(
 ) -> PushUpdateResponse:
     targets = await _resolve_targets(repo, req)
     tree_root = _master_tree_root()
-    sha = detect_git_sha(tree_root)
-    tarball = tar_working_tree(tree_root, extra_excludes=req.exclude)
+    # Both `detect_git_sha` (shells out) and `tar_working_tree` (walks the repo
+    # + gzips a few MB) are synchronous CPU+I/O. Running them directly on the
+    # event loop blocks every other request until the tarball is built — the
+    # dashboard freezes on /swarm-updates push. Offload to a worker thread.
+    sha = await asyncio.to_thread(detect_git_sha, tree_root)
+    tarball = await asyncio.to_thread(tar_working_tree, tree_root, extra_excludes=req.exclude)
     log.info(
         "swarm_updates.push sha=%s tarball=%d hosts=%d include_self=%s",
         sha or "(not a git repo)", len(tarball), len(targets), req.include_self,
diff --git a/decnet/web/router/swarm_updates/api_push_update_self.py b/decnet/web/router/swarm_updates/api_push_update_self.py
index 5908717..0f289fa 100644
--- a/decnet/web/router/swarm_updates/api_push_update_self.py
+++ b/decnet/web/router/swarm_updates/api_push_update_self.py
@@ -76,8 +76,10 @@ async def api_push_update_self(
 ) -> PushUpdateResponse:
     targets = await _resolve_targets(repo, req)
     tree_root = _master_tree_root()
-    sha = detect_git_sha(tree_root)
-    tarball = tar_working_tree(tree_root, extra_excludes=req.exclude)
+    # Offload sync I/O (git shell-out + tar+gzip of the repo) so the event
+    # loop stays responsive while the tarball is being built.
+    sha = await asyncio.to_thread(detect_git_sha, tree_root)
+    tarball = await asyncio.to_thread(tar_working_tree, tree_root, extra_excludes=req.exclude)
     log.info(
         "swarm_updates.push_self sha=%s tarball=%d hosts=%d",
         sha or "(not a git repo)", len(tarball), len(targets),