diff --git a/changelog.d/fixed-crux-pushbroker-finished-at.md b/changelog.d/fixed-crux-pushbroker-finished-at.md
new file mode 100644
index 0000000000..942e2d15aa
--- /dev/null
+++ b/changelog.d/fixed-crux-pushbroker-finished-at.md
@@ -0,0 +1 @@
+- crux/pushbroker: successful pushes now record `finished_at` in the audit result (previously only failures did) ([#14529](https://github.com/hivecommons/hive/issues/14529)).
diff --git a/src/crux/pushbroker/pushbroker.go b/src/crux/pushbroker/pushbroker.go
index e2a91444d0..a4266f3276 100644
--- a/src/crux/pushbroker/pushbroker.go
+++ b/src/crux/pushbroker/pushbroker.go
@@ -303,8 +303,8 @@ type Result struct {
 	FinishedAt      time.Time `json:"finished_at"`
 }
 
-func (b *Broker) Run(ctx context.Context) (Result, error) {
-	res := Result{Workspace: b.Workspace, Repo: b.Repo, Branch: b.Branch, Remote: b.remote(), StartedAt: b.now()}
+func (b *Broker) Run(ctx context.Context) (res Result, err error) {
+	res = Result{Workspace: b.Workspace, Repo: b.Repo, Branch: b.Branch, Remote: b.remote(), StartedAt: b.now()}
 	defer func() { res.FinishedAt = b.now() }()
 	if err := b.validate(); err != nil {
 		res.Error = err.Error()
diff --git a/src/crux/pushbroker/pushbroker_coverage_test.go b/src/crux/pushbroker/pushbroker_coverage_test.go
index 0674dee48c..207dc22fc8 100644
--- a/src/crux/pushbroker/pushbroker_coverage_test.go
+++ b/src/crux/pushbroker/pushbroker_coverage_test.go
@@ -121,6 +121,7 @@ func TestValidateRejectsUnusableConfigurations(t *testing.T) {
 // remote-ref default or the broker diffs the wrong range and can miss a
 // secret or a protected path introduced earlier in the branch.
 func TestRunPrefersAnExplicitBaseRef(t *testing.T) {
+	fixed := time.Date(2026, 8, 22, 12, 0, 0, 0, time.UTC)
 	git := &scriptedGit{replies: map[string]string{
 		"rev-parse HEAD":                         "cafebabe\n",
 		"rev-parse --verify origin/main":         "deadbeef\n",
@@ -130,6 +131,7 @@ func TestRunPrefersAnExplicitBaseRef(t *testing.T) {
 	res, err := (&Broker{
 		Workspace: fakeGitWorkspace(t), Branch: "work", BaseRef: "origin/main",
 		Repo: "hivecommons/hive", Minter: fakeMinter{"ghs_tok"}, Runner: git,
+		Now: func() time.Time { return fixed },
 	}).Run(context.Background())
 	if err != nil {
 		t.Fatalf("Run: %v (res=%+v)", err, res)
@@ -140,6 +142,9 @@ func TestRunPrefersAnExplicitBaseRef(t *testing.T) {
 	if slices.Contains(git.calls, "diff --name-only -z refs/remotes/origin/work...HEAD") {
 		t.Fatalf("broker diffed against the remote ref despite an explicit BaseRef: %v", git.calls)
 	}
+	if !res.StartedAt.Equal(fixed) || !res.FinishedAt.Equal(fixed) {
+		t.Fatalf("timestamps = %v/%v, want the injected clock %v", res.StartedAt, res.FinishedAt, fixed)
+	}
 }
 
 // With no BaseRef and no tracked remote branch (the first push of a new