diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 2681ed5..53a6c9f 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -32,7 +32,12 @@ jobs:
             set -euo pipefail
             echo "Starting explore deployment..."
             mkdir -p /opt/explore
+            chown root:root /opt/explore
             cd /opt/explore
+            # rsync vom Mac setzt uid 501 — Git als root braucht safe.directory
+            export GIT_CONFIG_COUNT=1
+            export GIT_CONFIG_KEY_0=safe.directory
+            export GIT_CONFIG_VALUE_0=/opt/explore
 
             if [ ! -d .git ]; then
               git init
diff --git a/deploy.sh b/deploy.sh
index b305f4c..2f7435b 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -18,6 +18,10 @@ fi
 
 mkdir -p "$PROJECT_DIR"
 cd "$PROJECT_DIR"
+# rsync vom Mac setzt uid 501 — Git als root braucht safe.directory
+export GIT_CONFIG_COUNT=1
+export GIT_CONFIG_KEY_0=safe.directory
+export GIT_CONFIG_VALUE_0="$PROJECT_DIR"
 
 if [ ! -d .git ]; then
   if git ls-remote "$GITEA_URL" HEAD &>/dev/null; then