diff --git a/.github/workflows/cli_release.yaml b/.github/workflows/cli_release.yaml
index dfbfa653454..aaa3bc935f6 100644
--- a/.github/workflows/cli_release.yaml
+++ b/.github/workflows/cli_release.yaml
@@ -135,6 +135,9 @@ jobs:
       uses: ./.github/actions/gcloud_creds
       with:
         SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
+    - name: Add pwd to git safe dir
+      run: |
+        git config --global --add safe.directory `pwd`
     - name: Upload signed CLI
       env:
         REF: ${{ github.event.ref }}
diff --git a/ci/cli_upload_signed.sh b/ci/cli_upload_signed.sh
index 5f56d5e4cce..8aef812b828 100755
--- a/ci/cli_upload_signed.sh
+++ b/ci/cli_upload_signed.sh
@@ -18,11 +18,11 @@
 
 repo_path=$(bazel info workspace)
 
+set -ex
+
 # shellcheck source=ci/artifact_utils.sh
 . "${repo_path}/ci/artifact_utils.sh"
 
-set -ex
-
 printenv
 
 release_tag=${TAG_NAME##*/v}