diff --git a/CHANGELOG.mkd b/CHANGELOG.mkd
index 25598076..727c81ac 100644
--- a/CHANGELOG.mkd
+++ b/CHANGELOG.mkd
@@ -8,6 +8,7 @@ Unreleased
 - Require Ruby 3.1 [#1402](https://github.com/puppetlabs/r10k/pull/1402)
 - Replace deprecated action: actions/setup-ruby->ruby/setup-ruby [#1406](https://github.com/puppetlabs/r10k/pull/1406)
 - Ensure git repositories are pruned on fetch [#1410](https://github.com/puppetlabs/r10k/pull/1410)
+- Limit Rugged Control Repo refspec to only clone refs/heads [#1412](https://github.com/puppetlabs/r10k/pull/1412)
 
 4.1.0
 -----
diff --git a/lib/r10k/git/rugged/bare_repository.rb b/lib/r10k/git/rugged/bare_repository.rb
index cb1a91e8..02404a42 100644
--- a/lib/r10k/git/rugged/bare_repository.rb
+++ b/lib/r10k/git/rugged/bare_repository.rb
@@ -36,7 +36,7 @@ def clone(remote)
     @_rugged_repo = ::Rugged::Repository.init_at(@path.to_s, true).tap do |repo|
       config = repo.config
       config['remote.origin.url']    = remote
-      config['remote.origin.fetch']  = '+refs/*:refs/*'
+      config['remote.origin.fetch']  = '+refs/heads/*:refs/heads/*'
       config['remote.origin.mirror'] = 'true'
     end
 
@@ -60,7 +60,7 @@ def fetch(remote_name='origin')
     proxy = R10K::Git.get_proxy_for_remote(remote)
 
     options = {:credentials => credentials, :prune => true, :proxy_url => proxy}
-    refspecs = ['+refs/*:refs/*']
+    refspecs = ['+refs/heads/*:refs/heads/*']
 
     results = nil