diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 13181a6ee..6b213e1a9 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -211,9 +211,28 @@ jobs:
       - uses: webfactory/ssh-agent@fc49353b67b2b7c1e0e6a600572d01a69f2672dd
         with:
           ssh-private-key: ${{ secrets[matrix.sshKey] }}
-
       - name: Split monorepo
         run: |
+          set -euxo pipefail
+
           ssh-add -l
           docker build -t monorepo-tools ./bin
-          docker run -v $PWD:/monorepo -w /monorepo -v $SSH_AUTH_SOCK:/ssh-agent -v ~/.ssh/known_hosts:/root/.ssh/known_hosts -e SSH_AUTH_SOCK=/ssh-agent monorepo-tools bin/split-repo.sh . ${{ matrix.repo }} ${{ matrix.path }} ${{ matrix.name }}/ ${{ matrix.lastTag}}
+
+          # Resolve absolute paths on the host
+          WORKTREE="$PWD"
+          GITDIR="$(git rev-parse --git-dir)"
+          [[ "${GITDIR}" != /* ]] && GITDIR="$WORKTREE/${GITDIR}"
+
+          echo "WORKTREE=${WORKTREE}"
+          echo "GITDIR=${GITDIR}"
+
+          # Run with identical absolute paths inside the container
+          docker run --rm \
+            -v "${WORKTREE}:${WORKTREE}" \
+            -v "${GITDIR}:${GITDIR}" \
+            -w "${WORKTREE}" \
+            -v "$SSH_AUTH_SOCK:/ssh-agent" \
+            -v "$HOME/.ssh/known_hosts:/root/.ssh/known_hosts" \
+            -e SSH_AUTH_SOCK=/ssh-agent \
+            monorepo-tools \
+            bin/split-repo.sh . "${{ matrix.repo }}" "${{ matrix.path }}" "${{ matrix.name }}/" "${{ matrix.lastTag }}"
diff --git a/bin/Dockerfile b/bin/Dockerfile
index bacda8607..c36300507 100644
--- a/bin/Dockerfile
+++ b/bin/Dockerfile
@@ -12,4 +12,5 @@ RUN echo "deb http://deb.debian.org/debian bookworm-backports main contrib non-f
         python3-packaging \
     && mkdir -p ~/.ssh || true \
     && chmod 700 ~/.ssh/ \
-    && ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
+    && ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts \
+    && git config --system --add safe.directory '*'
diff --git a/bin/split-repo.sh b/bin/split-repo.sh
index b724e37c8..8c062dc66 100755
--- a/bin/split-repo.sh
+++ b/bin/split-repo.sh
@@ -20,12 +20,19 @@ LIB_PATH="${3}"
 TAG_PREFIX="${4}"
 LAST_TAG_IN_SINGLEREPO="${5}"
 
-# We require the source to be a local path because we use --mirror flag. The --mirror flag is needed on the other hand
-# to copy all refs when doing a local clone.
-if [[ ! -d "${SOURCE_REPO_PATH}/.git" ]]; then
+echo ">> Splitting repo"
+echo "Source repo: ${SOURCE_REPO_PATH}"
+echo "Target repo: ${TARGET_REPO_URL}"
+echo "Library path: ${LIB_PATH}"
+echo "Tag prefix: ${TAG_PREFIX}"
+echo "Last tag in singlerepo: ${LAST_TAG_IN_SINGLEREPO}"
+
+if ! git -C "${SOURCE_REPO_PATH}" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
   echo "Source repo '${SOURCE_REPO_PATH}' is not a valid GIT repository"
   exit 1
 fi
+echo "Work tree: $(git -C "${SOURCE_REPO_PATH}" rev-parse --show-toplevel || true)"
+echo "Git dir:   $(git -C "${SOURCE_REPO_PATH}" rev-parse --git-dir || true)"
 
 TMP_DIR=`mktemp -d`
 WORK_DIR=`pwd`
@@ -37,8 +44,8 @@ clean_up () {
 trap clean_up EXIT
 
 echo ">> Cloning source repo '${SOURCE_REPO_PATH}'"
-cd $TMP_DIR
-git clone --no-local --mirror "${SOURCE_REPO_PATH}" $TMP_DIR
+REAL_GIT_DIR="$(git -C "${SOURCE_REPO_PATH}" rev-parse --git-dir)"
+git clone --no-local --mirror "${REAL_GIT_DIR}" "$TMP_DIR"
 
 echo ">> Rebuild repo"
 LIB_PATH="${LIB_PATH%/}/" # ensure trailing slash