diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml
index 484890fdb..a1630fb9b 100644
--- a/.github/workflows/cicd.yml
+++ b/.github/workflows/cicd.yml
@@ -44,6 +44,7 @@ jobs:
               - 'errors/**'
               - 'cert/**'
               - 'virt/**'
+              - 'git/**'
               - 'border0_api/**'
               - '.github/workflows/cicd.yml'
               - 'go.mod'
diff --git a/git/git.go b/git/git.go
index 436ff5f7b..46f126a66 100644
--- a/git/git.go
+++ b/git/git.go
@@ -11,6 +11,7 @@ import (
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/storage/memory"
 	log "github.com/sirupsen/logrus"
+	"github.com/srl-labs/containerlab/utils"
 )
 
 type GoGit struct {
@@ -216,6 +217,12 @@ func (g *GoGit) cloneNonExisting() error {
 		}
 		co.ReferenceName = plumbing.NewBranchReferenceName(branchName)
 	}
+	// pre-create the repo directory and adjust the ACLs
+	utils.CreateDirectory(g.gitRepo.GetName(), 0755)
+	err = utils.AdjustFileACLs(g.gitRepo.GetName())
+	if err != nil {
+		log.Warnf("failed to adjust repository (%s) ACLs. continuin anyways", g.gitRepo.GetName())
+	}
 
 	// perform clone
 	g.r, err = gogit.PlainClone(g.gitRepo.GetName(), false, co)