diff --git a/tool/actions-gh-release/git.go b/tool/actions-gh-release/git.go
index 4ba48dcb8c..8750f21863 100644
--- a/tool/actions-gh-release/git.go
+++ b/tool/actions-gh-release/git.go
@@ -171,3 +171,21 @@ func readFileAtCommit(ctx context.Context, gitExecPath, repoDir, filePath, commi
 
 	return bytes.TrimSpace(out), nil
 }
+
+func addSafeDirectory(ctx context.Context, gitExecPath, repoDir string) error {
+	args := []string{
+		"config",
+		"--global",
+		"--add",
+		"safe.directory",
+		repoDir,
+	}
+
+	cmd := exec.CommandContext(ctx, gitExecPath, args...)
+	cmd.Dir = repoDir
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("err: %w, out: %s", err, string(out))
+	}
+	return nil
+}
diff --git a/tool/actions-gh-release/main.go b/tool/actions-gh-release/main.go
index 8fa2117364..ed1c971def 100644
--- a/tool/actions-gh-release/main.go
+++ b/tool/actions-gh-release/main.go
@@ -49,6 +49,10 @@ func main() {
 		log.Fatal("GITHUB_WORKSPACE was not defined")
 	}
 
+	if err := addSafeDirectory(ctx, gitExecPath, workspace); err != nil {
+		log.Fatalf("Failed to add %s as a safe directory: %v\n", workspace, err)
+	}
+
 	cfg := &githubClientConfig{Token: args.Token}
 	ghClient := newGitHubClient(ctx, cfg)