diff --git a/.cirrus.yml b/.cirrus.yml
index 6d6c979f9c..fc5450ce32 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -133,6 +133,7 @@ build_task:
     #       the 'origin' remote must be defined, and all remote branches/tags
     #       must be available for reference from CI scripts.
     clone_script: &full_clone |
+          set -exuo pipefail
           cd /
           rm -rf $CIRRUS_WORKING_DIR
           mkdir -p $CIRRUS_WORKING_DIR
@@ -145,10 +146,6 @@ build_task:
           else
               git reset --hard $CIRRUS_CHANGE_IN_REPO
           fi
-          # Some test operations & checks require a git "identity"
-          _gc='git config --file /root/.gitconfig'
-          $_gc user.email "TMcTestFace@example.com"
-          $_gc user.name "Testy McTestface"
     # Attempt to prevent flakes by confirming basic environment expectations,
     # network service connectivity and essential container image availability.
     prebuild_script: &prebuild $SCRIPT_BASE/prebuild.sh
@@ -462,6 +459,7 @@ osx_alt_build_task:
         GOCACHE: "$CIRRUS_WORKING_DIR/.go/cache"
         GOENV: "$CIRRUS_WORKING_DIR/.go/support"
         GOSRC: "$HOME/ci/task-${CIRRUS_TASK_ID}"
+    clone_script: *full_clone
     # This host is/was shared with potentially many other CI tasks.
     # The previous task may have been canceled or aborted.
     prep_script: &mac_cleanup "contrib/cirrus/mac_cleanup.sh"
diff --git a/contrib/cirrus/mac_setup.sh b/contrib/cirrus/mac_setup.sh
index 3ab9163baf..1fd9042515 100755
--- a/contrib/cirrus/mac_setup.sh
+++ b/contrib/cirrus/mac_setup.sh
@@ -31,3 +31,10 @@ echo "TMPDIR=/private/tmp/ci" >> $CIRRUS_ENV
 
 # Removed completely during cleanup.
 mkdir -p /private/tmp/ci
+
+# Some test operations & checks require a git "identity"
+# N/B: $HOME in this context does not include the /ci part automatically
+# (see above) but it will when the next Cirrus-CI "_script" section
+# takes over.
+git config --file "$HOME/ci/.gitconfig" \
+  --add safe.directory $CIRRUS_WORKING_DIR
diff --git a/contrib/cirrus/setup_environment.sh b/contrib/cirrus/setup_environment.sh
index bf895be73a..024638dacf 100755
--- a/contrib/cirrus/setup_environment.sh
+++ b/contrib/cirrus/setup_environment.sh
@@ -40,12 +40,8 @@ done
 
 cp hack/podman-registry /bin
 
-# Some test operations & checks require a git "identity"
-_gc='git config --file /root/.gitconfig'
-showrun $_gc user.email "TMcTestFace@example.com"
-showrun $_gc user.name "Testy McTestface"
 # Bypass git safety/security checks when operating in a throwaway environment
-showrun git config --system --add safe.directory $GOSRC
+showrun git config --global --add safe.directory $GOSRC
 
 # Ensure that all lower-level contexts and child-processes have
 # ready access to higher level orchestration (e.g Cirrus-CI)