diff --git a/tests/gpg-flow.bats b/tests/gpg-flow.bats
index 8c74db3..06a45fe 100644
--- a/tests/gpg-flow.bats
+++ b/tests/gpg-flow.bats
@@ -79,7 +79,6 @@ EOF
 
   # Git repo for setup.sh (needs origin remote)
   git -C "$TEST_TMPDIR" init -q
-  git config --global --add safe.directory "$TEST_TMPDIR"
   git -C "$TEST_TMPDIR" remote add origin "git@github.com:test/repo.git"
 
   # SSH key for setup.sh
diff --git a/tests/helpers/setup.sh b/tests/helpers/setup.sh
index c25054b..0eb29fa 100644
--- a/tests/helpers/setup.sh
+++ b/tests/helpers/setup.sh
@@ -32,6 +32,9 @@ setup_test_env() {
 
   # No pause before an AUR clone or between attempts
   export AURTOMATOR_CLONE_DELAY=0 AURTOMATOR_RETRY_DELAY=0
+
+  # git reads and writes no global config of the user running the tests
+  export GIT_CONFIG_GLOBAL="$TEST_TMPDIR/gitconfig"
 }
 
 teardown_test_env() {
diff --git a/tests/scripts.bats b/tests/scripts.bats
index 7227f80..18fd238 100644
--- a/tests/scripts.bats
+++ b/tests/scripts.bats
@@ -10,6 +10,13 @@ teardown() {
   teardown_test_env
 }
 
+# === test environment ===
+
+@test "setup_test_env: git keeps its global config in the test directory" {
+  git config --global --add aurtomator.probe 1
+  [ "$(git config -f "$TEST_TMPDIR/gitconfig" aurtomator.probe)" = 1 ]
+}
+
 # === lib.sh ===
 
 @test "lib.sh: pkg_file resolves existing package" {
diff --git a/tests/setup.bats b/tests/setup.bats
index 08bc3d6..23a6d44 100644
--- a/tests/setup.bats
+++ b/tests/setup.bats
@@ -157,7 +157,6 @@ MOCKEOF
 
   # Init git repo with origin (for secrets step)
   git -C "$TEST_TMPDIR" init -q
-  git config --global --add safe.directory "$TEST_TMPDIR"
   git -C "$TEST_TMPDIR" remote add origin "git@github.com:test/repo.git"
 }