diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 5d81a8b7ae3..af0fe9b45ba 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -1005,6 +1005,9 @@ jobs:
         with:
           ref: refs/tags/${{ needs.cut.outputs.tag }}
 
+      - name: Trust the checked-out workspace in the job container
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Restore skill-sharing test harness from the workflow ref
         shell: bash
         env:
diff --git a/config/scripts/skill-sharing-release-workflow.test.mjs b/config/scripts/skill-sharing-release-workflow.test.mjs
index 4b963ae38f3..cd006d7bc34 100644
--- a/config/scripts/skill-sharing-release-workflow.test.mjs
+++ b/config/scripts/skill-sharing-release-workflow.test.mjs
@@ -51,6 +51,13 @@ describe('skill-sharing release workflow', () => {
     expect(prerequisites.run).toMatch(/apt-get install[^\n]*\bunzip\b/)
   })
 
+  it('trusts only the checked-out workspace before container git operations', () => {
+    const linux = workflow.jobs['skill-sharing-linux-floor-release-gate']
+    const trustWorkspace = stepNamed(linux, 'Trust the checked-out workspace in the job container')
+
+    expect(trustWorkspace.run).toBe('git config --global --add safe.directory "$GITHUB_WORKSPACE"')
+  })
+
   it('validates immutable tags with the current skill-sharing test harness', () => {
     for (const jobName of [
       'skill-sharing-release-gate',