diff --git a/Makefile b/Makefile
index ea9fa71..8e0f4c5 100644
--- a/Makefile
+++ b/Makefile
@@ -20,6 +20,8 @@ BUILD_ID := $(shell uuidgen | tr '[:upper:]' '[:lower:]')
 # the full and headless builds of one target share. Cargo still builds each in parallel.
 # Docker creates a missing volume owned by root, so the volume is handed to the build's user
 # first; otherwise a release after make clean cannot write to target/.
+# Docker Desktop can show the mounted tree's top directory as root's, which git refuses as
+# "dubious ownership" and GoReleaser reports as "not a git repository", so the tree is named safe.
 GORELEASER = mkdir -p $(CARGO_CACHE) && docker run --rm \
 	--user 0:0 \
 	--entrypoint chown \
@@ -29,6 +31,9 @@ GORELEASER = mkdir -p $(CARGO_CACHE) && docker run --rm \
 	--user $(shell id -u):$(shell id -g) \
 	-e CARGO_HOME=/cargo-home \
 	-e HOME=/tmp \
+	-e GIT_CONFIG_COUNT=1 \
+	-e GIT_CONFIG_KEY_0=safe.directory \
+	-e GIT_CONFIG_VALUE_0=/src \
 	-e MIDI_HARBOR_MAINTAINER="$(MIDI_HARBOR_MAINTAINER)" \
 	-e MIDI_HARBOR_VERSION="$(VERSION)" \
 	-e MIDI_HARBOR_BUILD_ID="$(BUILD_ID)" \