diff --git a/.github/mergify.yml b/.github/mergify.yml
index 49298b52..43353ea4 100644
--- a/.github/mergify.yml
+++ b/.github/mergify.yml
@@ -1,26 +1,34 @@
 # yaml-language-server: $schema=https://docs.mergify.com/mergify-configuration-schema.json
 extends: mergify
 merge_protections_settings:
   reporting_method: check-runs
 
 pull_request_rules:
   - name: Flag product T-ID format violation in PR title or commit messages
     description: >
-      Product-repo convention: PR title and every commit's first line must
-      match `T<digits>: <text>` (optional `scope: ` prefix). Relocated from
-      the central config (T8966) so the T-ID convention is opt-in per product
-      repo. Name is intentionally distinct from any central rule name so this
-      stays additive (not an `extends:` override).
+      Product-repo convention: the PR title AND every commit's first line must
+      match `T<digits>: <text>` (optional `scope: ` prefix). The title is always
+      checked; the per-commit check is exempted when a maintainer applies the
+      `legacy` label — an escape hatch for grandfathered PRs whose commit history
+      cannot be rewritten (repos that squash-merge AND block force-push, e.g.
+      vyos.vyos enforces `non_fast_forward` on ~ALL branches with zero bypass).
+      New PRs are still nudged toward the convention; `legacy` is the deliberate,
+      maintainer-controlled opt-out. Relocated from the central config (T8966)
+      so the convention is opt-in per product repo. Name is intentionally
+      distinct from any central rule name so this stays additive (not an
+      `extends:` override). Legacy-label escape added 2026-06-08 (T8966).
     conditions:
       - '-closed'
       - '-merged'
       - '-author~=\[bot\]$'
       - 'author!=copilot-swe-agent'
       - 'author!=vyosbot'
       - or:
           - '-title~=^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*'
-          - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*'
+          - and:
+              - 'label!=legacy'
+              - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*'
     actions:
       label:
         toggle:
           - invalid-task-id