diff --git a/src/com/homelab/stages/updateHelmTag.groovy b/src/com/homelab/stages/updateHelmTag.groovy
index 43a5d71..75ace30 100644
--- a/src/com/homelab/stages/updateHelmTag.groovy
+++ b/src/com/homelab/stages/updateHelmTag.groovy
@@ -49,8 +49,36 @@ def run(Map config) {
                     // missing trailing '}'`.
                     def urlParts = config.helm_repo_url.split('://', 2)
                     def authedUrl = "${urlParts[0]}://\${GIT_USER}:\${GIT_PASS}@${urlParts[1]}"
+                    // set -e added after a build showed "Cloning into
+                    // '.'..." with no further output, then a later git
+                    // command failing "not in a git directory" — without
+                    // set -e, a failed clone wouldn't have stopped the
+                    // script, letting later commands run against
+                    // whatever partial state was left behind and fail
+                    // with a confusing, disconnected error instead of
+                    // pointing straight at the clone.
+                    //
+                    // safe.directory added for the same failure: this
+                    // stage started running in container('docker-cli')
+                    // (root, docker:27-cli base has no non-root USER)
+                    // right when it broke, while deleteDir() just before
+                    // it runs via the Jenkins agent's own JNLP process
+                    // (a different, non-root UID) — modern git refuses
+                    // to trust a repo directory owned by a different UID
+                    // than the current process, and that refusal can
+                    // surface as an unrelated-looking "not a git
+                    // directory" on a *later* command instead of a clear
+                    // ownership error on the clone itself. Safe to trust
+                    // unconditionally here: this workspace is a
+                    // throwaway, container-local checkout for one build.
+                    // `git status` right after clone is a cheap
+                    // diagnostic that'll make the actual state obvious
+                    // if something else is still wrong.
                     sh """
+                        set -e
+                        git config --global --add safe.directory '*'
                         git clone ${authedUrl} .
+                        git status
                         yq -i '${config.image_tag_yq_path} = "${env.TAG}"' ${valuesFile}
                         git config user.email 'jenkins-ci@homelab.local'
                         git config user.name 'jenkins-ci'