diff --git a/.github/workflows/apps_version_check.yaml b/.github/workflows/apps_version_check.yaml
index 2ef18934f..59d6aebff 100644
--- a/.github/workflows/apps_version_check.yaml
+++ b/.github/workflows/apps_version_check.yaml
@@ -19,6 +19,8 @@ jobs:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0 # need full history
+      - name: fix-git-unsafe-repository
+        run: git config --global --add safe.directory /__w/emqx/emqx
       - name: Check relup (ce)
         if: endsWith(github.repository, 'emqx')
         run: ./scripts/update-appup.sh emqx --check
diff --git a/.github/workflows/build_slim_packages.yaml b/.github/workflows/build_slim_packages.yaml
index a10e72258..529faa559 100644
--- a/.github/workflows/build_slim_packages.yaml
+++ b/.github/workflows/build_slim_packages.yaml
@@ -29,6 +29,8 @@ jobs:
         else
           echo "EMQX_NAME=emqx" >> $GITHUB_ENV
         fi
+    - name: fix-git-unsafe-repository
+      run: git config --global --add safe.directory /__w/emqx/emqx
     - name: build zip packages
       run: make ${EMQX_NAME}-zip
     - name: build deb/rpm packages
diff --git a/.github/workflows/run_cts_tests.yaml b/.github/workflows/run_cts_tests.yaml
index 84aa301c4..6b05a014e 100644
--- a/.github/workflows/run_cts_tests.yaml
+++ b/.github/workflows/run_cts_tests.yaml
@@ -45,6 +45,8 @@ jobs:
           if make emqx-ee --dry-run > /dev/null 2>&1; then
             docker exec -i erlang bash -c "echo \"https://ci%40emqx.io:${{ secrets.CI_GIT_TOKEN }}@github.com\" > /root/.git-credentials && git config --global credential.helper store"
           fi
+      - name: fix-git-unsafe-repository
+        run: docker exec -i erlang sh -c "git config --global --add safe.directory /emqx"
       - name: run test cases
         run: |
           docker exec -i erlang sh -c "make ensure-rebar3"
@@ -115,6 +117,8 @@ jobs:
           if make emqx-ee --dry-run > /dev/null 2>&1; then
             docker exec -i erlang bash -c "echo \"https://ci%40emqx.io:${{ secrets.CI_GIT_TOKEN }}@github.com\" > /root/.git-credentials && git config --global credential.helper store"
           fi
+      - name: fix-git-unsafe-repository
+        run: docker exec -i erlang sh -c "git config --global --add safe.directory /emqx"
       - name: run test cases
         run: |
           printenv | grep "^EMQX_" > .env
@@ -197,6 +201,8 @@ jobs:
           if make emqx-ee --dry-run > /dev/null 2>&1; then
             docker exec -i erlang bash -c "echo \"https://ci%40emqx.io:${{ secrets.CI_GIT_TOKEN }}@github.com\" > /root/.git-credentials && git config --global credential.helper store"
           fi
+      - name: fix-git-unsafe-repository
+        run: docker exec -i erlang sh -c "git config --global --add safe.directory /emqx"
       - name: run test cases
         run: |
           printenv | grep "^EMQX_" > .env
@@ -268,6 +274,8 @@ jobs:
           if make emqx-ee --dry-run > /dev/null 2>&1; then
             docker exec -i erlang bash -c "echo \"https://ci%40emqx.io:${{ secrets.CI_GIT_TOKEN }}@github.com\" > /root/.git-credentials && git config --global credential.helper store"
           fi
+      - name: fix-git-unsafe-repository
+        run: docker exec -i erlang sh -c "git config --global --add safe.directory /emqx"
       - name: run test cases
         run: |
           export EMQX_AUTH__PGSQL__USERNAME=root \
@@ -391,6 +399,8 @@ jobs:
           if make emqx-ee --dry-run > /dev/null 2>&1; then
             docker exec -i erlang bash -c "echo \"https://ci%40emqx.io:${{ secrets.CI_GIT_TOKEN }}@github.com\" > /root/.git-credentials && git config --global credential.helper store"
           fi
+      - name: fix-git-unsafe-repository
+        run: docker exec -i erlang sh -c "git config --global --add safe.directory /emqx"
       - name: run test cases
         run: |
           export EMQX_AUTH__REIDS__PASSWORD=public