diff --git a/app/models/git_repository.rb b/app/models/git_repository.rb
index da747afad977..6dd7f953e745 100644
--- a/app/models/git_repository.rb
+++ b/app/models/git_repository.rb
@@ -2,6 +2,7 @@
 
 class GitRepository < ApplicationRecord
   include AuthenticationMixin
+  belongs_to :authentication
 
   GIT_REPO_DIRECTORY = Rails.root.join('data/git_repos')
 
@@ -158,9 +159,9 @@ def handling_worktree_errors
   def worktree_params
     params = {:path => directory_name}
     params[:certificate_check] = method(:self_signed_cert_cb) if verify_ssl == OpenSSL::SSL::VERIFY_NONE
-    if authentications.any?
-      params[:username] = default_authentication.userid
-      params[:password] = default_authentication.password
+    if (auth = authentication || default_authentication)
+      params[:username] = auth.userid
+      params[:password] = auth.password
     end
     params
   end
diff --git a/app/models/manageiq/providers/embedded_ansible/automation_manager/configuration_script_source.rb b/app/models/manageiq/providers/embedded_ansible/automation_manager/configuration_script_source.rb
index c76285a64e83..700dbd8a43e4 100644
--- a/app/models/manageiq/providers/embedded_ansible/automation_manager/configuration_script_source.rb
+++ b/app/models/manageiq/providers/embedded_ansible/automation_manager/configuration_script_source.rb
@@ -8,7 +8,8 @@ class ManageIQ::Providers::EmbeddedAnsible::AutomationManager::ConfigurationScri
   default_value_for :scm_type,   "git"
   default_value_for :scm_branch, "master"
 
-  belongs_to :git_repository, :dependent => :destroy
+  belongs_to :git_repository, :autosave => true, :dependent => :destroy
+  before_validation :sync_git_repository
 
   include ManageIQ::Providers::EmbeddedAnsible::CrudCommon
 
@@ -46,14 +47,27 @@ def raw_delete_in_provider
   end
 
   def git_repository
-    super || begin
-      transaction do
-        update!(:git_repository => GitRepository.create!(:url => scm_url))
+    (super || (ensure_git_repository && super)).tap { |r| sync_git_repository(r) }
+  end
+
+  private def ensure_git_repository
+    transaction do
+      repo = GitRepository.create!(:url => scm_url)
+      if new_record?
+        self.git_repository_id = repo.id
+      else
+        update_columns(:git_repository_id => repo.id)
       end
-      super
     end
   end
 
+  private def sync_git_repository(git_repository = nil)
+    return unless name_changed? || scm_url_changed? || authentication_id_changed?
+
+    git_repository ||= self.git_repository
+    git_repository.attributes = {:name => name, :url => scm_url, :authentication_id => authentication_id}
+  end
+
   def sync
     update_attributes!(:status => "running")
     transaction do
diff --git a/spec/factories/configuration_script_source.rb b/spec/factories/configuration_script_source.rb
index 90d5b56e4c52..ebed6e67bc4e 100644
--- a/spec/factories/configuration_script_source.rb
+++ b/spec/factories/configuration_script_source.rb
@@ -9,5 +9,7 @@
 
   factory :embedded_ansible_configuration_script_source,
           :parent => :configuration_script_source,
-          :class  => "ManageIQ::Providers::EmbeddedAnsible::AutomationManager::ConfigurationScriptSource"
+          :class  => "ManageIQ::Providers::EmbeddedAnsible::AutomationManager::ConfigurationScriptSource" do
+    scm_url { "https://example.com/foo.git" }
+  end
 end
diff --git a/spec/models/manageiq/providers/embedded_ansible/automation_manager/configuration_script_source_spec.rb b/spec/models/manageiq/providers/embedded_ansible/automation_manager/configuration_script_source_spec.rb
index 91610bde326e..e7105bbf52c4 100644
--- a/spec/models/manageiq/providers/embedded_ansible/automation_manager/configuration_script_source_spec.rb
+++ b/spec/models/manageiq/providers/embedded_ansible/automation_manager/configuration_script_source_spec.rb
@@ -139,7 +139,7 @@ def files_in_repository(git_repo_dir)
 
         expect(Notification).to receive(:create!).with(notify_creation_args)
         expect(Notification).to receive(:create!).with(sync_notification_args)
-        expect(GitRepository).to receive(:create!).and_raise(::Rugged::NetworkError)
+        allow_any_instance_of(GitRepository).to receive(:with_worktree).and_raise(::Rugged::NetworkError)
 
         expect do
           described_class.create_in_provider(manager.id, params)
@@ -166,7 +166,7 @@ def files_in_repository(git_repo_dir)
         expect(result.last_updated_on).to be_an(Time)
         expect(result.last_update_error).to start_with("Rugged::NetworkError")
 
-        expect(GitRepository).to receive(:create!).and_call_original
+        allow_any_instance_of(GitRepository).to receive(:with_worktree).and_call_original
 
         result.sync