diff --git a/knotserver/xrpc/create_repo.go b/knotserver/xrpc/create_repo.go
--- a/knotserver/xrpc/create_repo.go
+++ b/knotserver/xrpc/create_repo.go
@@ -145,6 +145,7 @@ l = l.With("repoDid", repoDid)
 
 	repoPath, _ := securejoin.SecureJoin(h.Config.Repo.ScanPath, repoDid)
 	rbacPath := repoDid
+	repoAddedToRBAC := false
 
 	cleanup := func() {
 		if rmErr := os.RemoveAll(repoPath); rmErr != nil {
@@ -153,6 +154,11 @@ }
 	}
 
 	cleanupAll := func() {
+		if repoAddedToRBAC {
+			if rmErr := h.Enforcer.RemoveRepo(actorDid.String(), rbac.ThisServer, rbacPath); rmErr != nil {
+				l.Error("failed to clean up repo permissions", "error", rmErr.Error())
+			}
+		}
 		cleanup()
 		if delErr := h.Db.DeleteRepoKey(repoDid); delErr != nil {
 			l.Error("failed to clean up repo key", "error", delErr.Error())
@@ -195,17 +201,6 @@ return
 		}
 	}
 
-	if prepared != nil {
-		plcCtx, plcCancel := context.WithTimeout(context.Background(), 30*time.Second)
-		defer plcCancel()
-		if err := prepared.Submit(plcCtx); err != nil {
-			l.Error("submitting to PLC directory", "error", err.Error())
-			cleanupAll()
-			writeError(w, xrpcerr.GenericError(fmt.Errorf("PLC directory submission failed: %w", err)), http.StatusInternalServerError)
-			return
-		}
-	}
-
 	// add perms for this user to access the repo
 	err = h.Enforcer.AddRepo(actorDid.String(), rbac.ThisServer, rbacPath)
 	if err != nil {
@@ -214,14 +209,31 @@ cleanupAll()
 		writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
 		return
 	}
+	repoAddedToRBAC = true
 
-	hook.SetupRepo(
+	if err := hook.SetupRepo(
 		hook.Config(
 			hook.WithScanPath(h.Config.Repo.ScanPath),
 			hook.WithInternalApi(h.Config.Server.InternalListenAddr),
 		),
 		repoPath,
-	)
+	); err != nil {
+		l.Error("setting up repo hooks", "error", err.Error())
+		cleanupAll()
+		writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError)
+		return
+	}
+
+	if prepared != nil {
+		plcCtx, plcCancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer plcCancel()
+		if err := prepared.Submit(plcCtx); err != nil {
+			l.Error("submitting to PLC directory", "error", err.Error())
+			cleanupAll()
+			writeError(w, xrpcerr.GenericError(fmt.Errorf("PLC directory submission failed: %w", err)), http.StatusInternalServerError)
+			return
+		}
+	}
 
 	// HACK: request crawl for this repository
 	// Users won't want to sync entire network from their local knotmirror.