diff --git a/tests/functional/common/vars.sh b/tests/functional/common/vars.sh
index d4d917dae8d..a6b83ae4e3c 100644
--- a/tests/functional/common/vars.sh
+++ b/tests/functional/common/vars.sh
@@ -64,6 +64,9 @@ unset XDG_CONFIG_HOME
 unset XDG_CONFIG_DIRS
 unset XDG_CACHE_HOME
 unset GIT_DIR
+# Isolate tests from host git config (signing, url rewrites, etc.)
+export GIT_CONFIG_SYSTEM=/dev/null
+export GIT_CONFIG_GLOBAL=/dev/null
 
 export IMPURE_VAR1=foo
 export IMPURE_VAR2=bar
diff --git a/tests/functional/fetchGitSubmodules.sh b/tests/functional/fetchGitSubmodules.sh
index bf5fe5df387..74997d0daac 100755
--- a/tests/functional/fetchGitSubmodules.sh
+++ b/tests/functional/fetchGitSubmodules.sh
@@ -18,9 +18,11 @@ rm -rf "${rootRepo}" "${subRepo}" "$TEST_HOME"/.cache/nix
 # submodule is intentionally local and it's all trusted, so we
 # disable this restriction. Setting it per repo is not sufficient, as
 # the repo-local config does not apply to the commands run from
-# outside the repos by Nix.
-export XDG_CONFIG_HOME=$TEST_HOME/.config
-git config --global protocol.file.allow always
+# outside the repos by Nix. We use environment variables to avoid
+# attempting to write to a read-only system git config.
+export GIT_CONFIG_COUNT=1
+export GIT_CONFIG_KEY_0=protocol.file.allow
+export GIT_CONFIG_VALUE_0=always
 
 addGitContent() {
     echo "lorem ipsum" > "$1"/content
diff --git a/tests/functional/flakes/flake-in-submodule.sh b/tests/functional/flakes/flake-in-submodule.sh
index a7d86698de8..e0794f014c0 100755
--- a/tests/functional/flakes/flake-in-submodule.sh
+++ b/tests/functional/flakes/flake-in-submodule.sh
@@ -21,8 +21,9 @@ clearStore
 
 # Submodules can't be fetched locally by default.
 # See fetchGitSubmodules.sh
-export XDG_CONFIG_HOME=$TEST_HOME/.config
-git config --global protocol.file.allow always
+export GIT_CONFIG_COUNT=1
+export GIT_CONFIG_KEY_0=protocol.file.allow
+export GIT_CONFIG_VALUE_0=always
 
 
 rootRepo=$TEST_ROOT/rootRepo