diff --git a/.github/workflows/cygwin-test.yml b/.github/workflows/cygwin-test.yml
index 6ba63f019..808dc5608 100644
--- a/.github/workflows/cygwin-test.yml
+++ b/.github/workflows/cygwin-test.yml
@@ -12,7 +12,7 @@ jobs:
       SHELLOPTS: igncr
       TMP: "/tmp"
       TEMP: "/tmp"
-    
+
     steps:
     - name: Force LF line endings
       run: git config --global core.autocrlf input
@@ -24,9 +24,8 @@ jobs:
         packages: python39 python39-pip python39-virtualenv git
     - name: Tell git to trust this repo
       shell: bash.exe -eo pipefail -o igncr "{0}"
-      run: | 
-          /usr/bin/git config --global --add safe.directory $(pwd)
-          /usr/bin/git config --global protocol.file.allow always
+      run: |
+          /usr/bin/git config --global --add safe.directory "$(pwd)"
     - name: Install dependencies and prepare tests
       shell: bash.exe -eo pipefail -o igncr "{0}"
       run: |
diff --git a/.github/workflows/pythonpackage.yml b/.github/workflows/pythonpackage.yml
index 68988f2a7..a6af507d1 100644
--- a/.github/workflows/pythonpackage.yml
+++ b/.github/workflows/pythonpackage.yml
@@ -52,11 +52,6 @@ jobs:
         set -x
         mypy -p git
 
-    - name: Tell git to trust this repo
-      run: | 
-          /usr/bin/git config --global --add safe.directory $(pwd)
-          /usr/bin/git config --global protocol.file.allow always
-
     - name: Test with pytest
       run: |
         set -x
diff --git a/test/test_submodule.py b/test/test_submodule.py
index 982226411..d906a5d5b 100644
--- a/test/test_submodule.py
+++ b/test/test_submodule.py
@@ -1,12 +1,13 @@
 # -*- coding: utf-8 -*-
 # This module is part of GitPython and is released under
 # the BSD License: http://www.opensource.org/licenses/bsd-license.php
+import contextlib
 import os
 import shutil
 import tempfile
 from pathlib import Path
 import sys
-from unittest import skipIf
+from unittest import mock, skipIf
 
 import pytest
 
@@ -31,6 +32,23 @@
 import os.path as osp
 
 
+@contextlib.contextmanager
+def _patch_git_config(name, value):
+    """Temporarily add a git config name-value pair, using environment variables."""
+    pair_index = int(os.getenv("GIT_CONFIG_COUNT", "0"))
+
+    # This is recomputed each time the context is entered, for compatibility with
+    # existing GIT_CONFIG_* environment variables, even if changed in this process.
+    patcher = mock.patch.dict(os.environ, {
+        "GIT_CONFIG_COUNT": str(pair_index + 1),
+        f"GIT_CONFIG_KEY_{pair_index}": name,
+        f"GIT_CONFIG_VALUE_{pair_index}": value,
+    })
+
+    with patcher:
+        yield
+
+
 class TestRootProgress(RootUpdateProgress):
     """Just prints messages, for now without checking the correctness of the states"""
 
@@ -709,6 +727,7 @@ def test_add_empty_repo(self, rwdir):
         # end for each checkout mode
 
     @with_rw_directory
+    @_patch_git_config("protocol.file.allow", "always")
     def test_list_only_valid_submodules(self, rwdir):
         repo_path = osp.join(rwdir, "parent")
         repo = git.Repo.init(repo_path)
@@ -737,6 +756,7 @@ def test_list_only_valid_submodules(self, rwdir):
                 """,
     )
     @with_rw_directory
+    @_patch_git_config("protocol.file.allow", "always")
     def test_git_submodules_and_add_sm_with_new_commit(self, rwdir):
         parent = git.Repo.init(osp.join(rwdir, "parent"))
         parent.git.submodule("add", self._small_repo_url(), "module")