diff --git a/ci-build-and-publish-ota.sh b/ci-build-and-publish-ota.sh
index 46457db..082552e 100755
--- a/ci-build-and-publish-ota.sh
+++ b/ci-build-and-publish-ota.sh
@@ -31,6 +31,12 @@ exec > >(tee -a "${OUT_DIR}/build.log") 2>&1
 
 echo "==> Phase: init build_id=${BUILD_ID} channel=${OTA_CHANNEL}"
 
+# Isolated trees are cloned by PHP-FPM (nobody); container runs as root.
+if [[ -d "${ROOT}/.git" ]]; then
+  git config --global --add safe.directory "${ROOT}" 2>/dev/null || true
+  git config --global --add safe.directory '*' 2>/dev/null || true
+fi
+
 if [[ -n "${GIT_REF:-}" ]]; then
   echo "==> Phase: git checkout ${GIT_REF}"
   current_head="$(git rev-parse HEAD 2>/dev/null || echo "")"