diff --git a/ci-automation/release.sh b/ci-automation/release.sh
index 1433b05853..f0e8efc27b 100644
--- a/ci-automation/release.sh
+++ b/ci-automation/release.sh
@@ -208,7 +208,7 @@ function _release_build_impl() {
 
     touch sdk_container/.env # This file should already contain the required credentials as env vars
     docker run --pull always --rm --name="${container_name}" --net host \
-      -w /work -v "$PWD":/work "${mantle_ref}" bash -c "source ci-automation/release.sh; _inside_mantle"
+      -w /work -v "$PWD":/work "${mantle_ref}" bash -c "git config --global --add safe.directory /work && source ci-automation/release.sh && _inside_mantle"
     # Push flatcar_production_ami_*txt and flatcar_production_ami_*json to the right bincache folder
     for arch in amd64 arm64; do
       sudo chown -R "$USER:$USER" "aws-${arch}"
diff --git a/ci-automation/test.sh b/ci-automation/test.sh
index 6be101ee16..c9ec153a3d 100644
--- a/ci-automation/test.sh
+++ b/ci-automation/test.sh
@@ -186,7 +186,7 @@ function _test_run_impl() {
         touch sdk_container/.env
         docker run --pull always --rm --name="${container_name}" --privileged --net host -v /dev:/dev \
           -w /work -v "$PWD":/work "${mantle_ref}" \
-         bash -c "set -o noglob && source sdk_container/.env && ci-automation/vendor-testing/${image}.sh \
+         bash -c "set -o noglob && git config --global --add safe.directory /work && source sdk_container/.env && ci-automation/vendor-testing/${image}.sh \
                 \"${work_dir}\" \
                 \"${tests_dir}\" \
                 \"${arch}\" \
@@ -196,6 +196,7 @@ function _test_run_impl() {
         set -e
         rm -f "${work_dir}/first_run"
 
+        # Note: git safe.directory is not set in this run as it does not use git
         docker run --pull always --rm --name="${container_name}" --privileged --net host -v /dev:/dev \
           -w /work -v "$PWD":/work "${mantle_ref}" \
             ci-automation/test_update_reruns.sh \