diff --git a/deploy/nixos/download.nix b/deploy/nixos/download.nix
index 37c076f..07088e6 100644
--- a/deploy/nixos/download.nix
+++ b/deploy/nixos/download.nix
@@ -200,6 +200,13 @@ in
 
       script = ''
         set -euo pipefail
+
+        # The service runs as root but the checkout is owned by another user;
+        # allow git to operate on it without a persistent global config.
+        export GIT_CONFIG_COUNT=1
+        export GIT_CONFIG_KEY_0=safe.directory
+        export GIT_CONFIG_VALUE_0="${cfg.workingDir}"
+
         if [ ! -d "${cfg.workingDir}/.git" ]; then
           git clone ${cfg.repoUrl} ${cfg.workingDir}
         else