diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index d0daa83fc2fd35..c9f2c02d7d866f 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -60,7 +60,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
             - name: Try to ensure the directories for core dumping exist and we
                   can write them.
               run: |
@@ -177,7 +177,7 @@ jobs:
             #   with:
             #      languages: "cpp"
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
             - name: Try to ensure the directories for core dumping exist and we
                   can write them.
               run: |
@@ -342,7 +342,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
 
             - name: Bootstrap cache
               uses: actions/cache@v3
@@ -398,7 +398,7 @@ jobs:
             #  with:
             #     languages: "cpp"
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform darwin
+              run: scripts/checkout_submodules.py --configure --shallow --platform darwin
             - name: Try to ensure the directory for diagnostic log collection exists
               run: |
                   mkdir -p ~/Library/Logs/DiagnosticReports || true
@@ -501,7 +501,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
 
             - name: Bootstrap cache
               uses: actions/cache@v3
diff --git a/.github/workflows/chef.yaml b/.github/workflows/chef.yaml
index ab8622f64be6c4..67b0799b9d85d8 100644
--- a/.github/workflows/chef.yaml
+++ b/.github/workflows/chef.yaml
@@ -43,7 +43,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
             - name: Bootstrap cache
               uses: actions/cache@v3
               timeout-minutes: 10
@@ -79,7 +79,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform esp32
+              run: scripts/checkout_submodules.py --configure --shallow --platform esp32
             - name: Bootstrap cache
               uses: actions/cache@v3
               timeout-minutes: 10
@@ -115,7 +115,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform nrfconnect
+              run: scripts/checkout_submodules.py --configure --shallow --platform nrfconnect
             - name: Bootstrap cache
               uses: actions/cache@v3
               timeout-minutes: 10
diff --git a/.github/workflows/cirque.yaml b/.github/workflows/cirque.yaml
index ea5d4c3755c56d..f1b95f7f64a8b3 100644
--- a/.github/workflows/cirque.yaml
+++ b/.github/workflows/cirque.yaml
@@ -58,7 +58,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
 
             - name: Bootstrap cache
               uses: actions/cache@v3
diff --git a/.github/workflows/darwin-tests.yaml b/.github/workflows/darwin-tests.yaml
index a0c8642d557d04..fc63290d622913 100644
--- a/.github/workflows/darwin-tests.yaml
+++ b/.github/workflows/darwin-tests.yaml
@@ -54,7 +54,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform darwin
+              run: scripts/checkout_submodules.py --configure --shallow --platform darwin
             - name: Setup Environment
               # coreutils for stdbuf
               run: brew install coreutils
diff --git a/.github/workflows/darwin.yaml b/.github/workflows/darwin.yaml
index 5f054d177001bb..41f27b6cb824f8 100644
--- a/.github/workflows/darwin.yaml
+++ b/.github/workflows/darwin.yaml
@@ -42,7 +42,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform darwin
+              run: scripts/checkout_submodules.py --configure --shallow --platform darwin
             - name: Setup Environment
               run: brew install python@3.9
 
diff --git a/.github/workflows/examples-ameba.yaml b/.github/workflows/examples-ameba.yaml
index 3ed0d5a866bc15..97aad2fda6edd5 100644
--- a/.github/workflows/examples-ameba.yaml
+++ b/.github/workflows/examples-ameba.yaml
@@ -49,7 +49,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform ameba
+              run: scripts/checkout_submodules.py --configure --shallow --platform ameba
             - name: Bootstrap cache
               uses: actions/cache@v3
               timeout-minutes: 10
diff --git a/.github/workflows/examples-bouffalolab.yaml b/.github/workflows/examples-bouffalolab.yaml
index 1760458c2b03ab..f4732a7db9e877 100644
--- a/.github/workflows/examples-bouffalolab.yaml
+++ b/.github/workflows/examples-bouffalolab.yaml
@@ -49,7 +49,7 @@ jobs:
           attempt_limit: 3
           attempt_delay: 2000
       - name: Checkout submodules
-        run: scripts/checkout_submodules.py --shallow --platform bouffalolab --recursive
+        run: scripts/checkout_submodules.py --configure --shallow --platform bouffalolab --recursive
 
       - name: Set up environment for size reports
         if: ${{ !env.ACT }}
diff --git a/.github/workflows/examples-cc13x2x7_26x2x7.yaml b/.github/workflows/examples-cc13x2x7_26x2x7.yaml
index 254c4a041c8ccf..91b5c0b5deb0c0 100644
--- a/.github/workflows/examples-cc13x2x7_26x2x7.yaml
+++ b/.github/workflows/examples-cc13x2x7_26x2x7.yaml
@@ -51,7 +51,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform cc13x2_26x2
+              run: scripts/checkout_submodules.py --configure --shallow --platform cc13x2_26x2
             - name: Set up environment for size reports
               if: ${{ !env.ACT }}
               env:
diff --git a/.github/workflows/examples-cc32xx.yaml b/.github/workflows/examples-cc32xx.yaml
index fed502b34d7530..bac5a6e9488118 100644
--- a/.github/workflows/examples-cc32xx.yaml
+++ b/.github/workflows/examples-cc32xx.yaml
@@ -48,7 +48,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform cc32xx
+              run: scripts/checkout_submodules.py --configure --shallow --platform cc32xx
             - name: Set up environment for size reports
               if: ${{ !env.ACT }}
               env:
diff --git a/.github/workflows/examples-efr32.yaml b/.github/workflows/examples-efr32.yaml
index 084226e14510a0..d9e1cc252de03f 100644
--- a/.github/workflows/examples-efr32.yaml
+++ b/.github/workflows/examples-efr32.yaml
@@ -52,7 +52,7 @@ jobs:
           attempt_limit: 3
           attempt_delay: 2000
       - name: Checkout submodules
-        run: scripts/checkout_submodules.py --shallow --platform silabs_docker
+        run: scripts/checkout_submodules.py --configure --shallow --platform silabs_docker
 
       # - name: Out of Tree verification
       #   run: third_party/silabs/out_of_tree_verification.sh
diff --git a/.github/workflows/examples-esp32.yaml b/.github/workflows/examples-esp32.yaml
index 74dee213b71be8..ad0be0665c6b45 100644
--- a/.github/workflows/examples-esp32.yaml
+++ b/.github/workflows/examples-esp32.yaml
@@ -49,7 +49,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform esp32
+              run: scripts/checkout_submodules.py --configure --shallow --platform esp32
 
             - name: Set up environment for size reports
               if: ${{ !env.ACT }}
@@ -172,7 +172,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform esp32
+              run: scripts/checkout_submodules.py --configure --shallow --platform esp32
 
             - name: Bootstrap cache
               uses: actions/cache@v3
diff --git a/.github/workflows/examples-infineon.yaml b/.github/workflows/examples-infineon.yaml
index 46db43bca68fa7..f5587c336f5927 100644
--- a/.github/workflows/examples-infineon.yaml
+++ b/.github/workflows/examples-infineon.yaml
@@ -49,7 +49,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform infineon
+              run: scripts/checkout_submodules.py --configure --shallow --platform infineon
 
             - name: Set up environment for size reports
               if: ${{ !env.ACT }}
diff --git a/.github/workflows/examples-k32w.yaml b/.github/workflows/examples-k32w.yaml
index 77b9826f6f8231..fb6d785d14ad8c 100644
--- a/.github/workflows/examples-k32w.yaml
+++ b/.github/workflows/examples-k32w.yaml
@@ -51,7 +51,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform k32w0
+              run: scripts/checkout_submodules.py --configure --shallow --platform k32w0
 
             - name: Set up environment for size reports
               if: ${{ !env.ACT }}
diff --git a/.github/workflows/examples-linux-arm.yaml b/.github/workflows/examples-linux-arm.yaml
index f0b78a5b46b383..224fbf0d589664 100644
--- a/.github/workflows/examples-linux-arm.yaml
+++ b/.github/workflows/examples-linux-arm.yaml
@@ -49,7 +49,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
 
             - name: Set up environment for size reports
               if: ${{ !env.ACT }}
diff --git a/.github/workflows/examples-linux-imx.yaml b/.github/workflows/examples-linux-imx.yaml
index ded33cb5756ae9..5bdcfa84f80bd5 100644
--- a/.github/workflows/examples-linux-imx.yaml
+++ b/.github/workflows/examples-linux-imx.yaml
@@ -47,7 +47,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
 
             - name: Bootstrap cache
               uses: actions/cache@v3
diff --git a/.github/workflows/examples-linux-standalone.yaml b/.github/workflows/examples-linux-standalone.yaml
index 8d2d87f067b916..51277f4a725c38 100644
--- a/.github/workflows/examples-linux-standalone.yaml
+++ b/.github/workflows/examples-linux-standalone.yaml
@@ -49,7 +49,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
 
             - name: Set up environment for size reports
               if: ${{ !env.ACT }}
diff --git a/.github/workflows/examples-mbed.yaml b/.github/workflows/examples-mbed.yaml
index 53da5ba28ba613..7b1c0fe7ce0b75 100644
--- a/.github/workflows/examples-mbed.yaml
+++ b/.github/workflows/examples-mbed.yaml
@@ -55,7 +55,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform mbed
+              run: scripts/checkout_submodules.py --configure --shallow --platform mbed
 
             - name: Detect changed paths
               uses: dorny/paths-filter@v2
diff --git a/.github/workflows/examples-mw320.yaml b/.github/workflows/examples-mw320.yaml
index 1aea2f34557a52..383dbd51677a72 100755
--- a/.github/workflows/examples-mw320.yaml
+++ b/.github/workflows/examples-mw320.yaml
@@ -51,7 +51,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform mw320
+              run: scripts/checkout_submodules.py --configure --shallow --platform mw320
 
             - name: Set up environment for size reports
               if: ${{ !env.ACT }}
diff --git a/.github/workflows/examples-nrfconnect.yaml b/.github/workflows/examples-nrfconnect.yaml
index 4f0efb889359c8..b4c4c285b1a0d4 100644
--- a/.github/workflows/examples-nrfconnect.yaml
+++ b/.github/workflows/examples-nrfconnect.yaml
@@ -52,7 +52,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform nrfconnect
+              run: scripts/checkout_submodules.py --configure --shallow --platform nrfconnect
             - name: Detect changed paths
               uses: dorny/paths-filter@v2
               id: changed_paths
diff --git a/.github/workflows/examples-openiotsdk.yaml b/.github/workflows/examples-openiotsdk.yaml
index ddf3868d878cc1..97ce9b6eb68f41 100644
--- a/.github/workflows/examples-openiotsdk.yaml
+++ b/.github/workflows/examples-openiotsdk.yaml
@@ -51,7 +51,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --recursive --platform openiotsdk
+              run: scripts/checkout_submodules.py --configure --shallow --recursive --platform openiotsdk
 
             - name: Set up environment for size reports
               if: ${{ !env.ACT }}
diff --git a/.github/workflows/examples-qpg.yaml b/.github/workflows/examples-qpg.yaml
index 65376a17a86490..1b2801ce6e9d7b 100644
--- a/.github/workflows/examples-qpg.yaml
+++ b/.github/workflows/examples-qpg.yaml
@@ -51,7 +51,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform qpg
+              run: scripts/checkout_submodules.py --configure --shallow --platform qpg
 
             - name: Set up environment for size reports
               if: ${{ !env.ACT }}
diff --git a/.github/workflows/examples-telink.yaml b/.github/workflows/examples-telink.yaml
index df6c31813167e1..8b5c6a31ab6255 100644
--- a/.github/workflows/examples-telink.yaml
+++ b/.github/workflows/examples-telink.yaml
@@ -132,7 +132,7 @@ jobs:
 
             - name: Build example Telink Lighting App with Factory Data
               run: |
-                  ./scripts/checkout_submodules.py --shallow --platform linux
+                  ./scripts/checkout_submodules.py --configure --shallow --platform linux
                   ./scripts/build/gn_gen.sh
                   ./scripts/run_in_build_env.sh "ninja -C ./out/$BUILD_TYPE chip-cert chip-tool spake2p"
                   ./scripts/run_in_build_env.sh \
diff --git a/.github/workflows/examples-tizen.yaml b/.github/workflows/examples-tizen.yaml
index b5d4c33ece6542..d706c43aebdc96 100644
--- a/.github/workflows/examples-tizen.yaml
+++ b/.github/workflows/examples-tizen.yaml
@@ -50,7 +50,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform tizen
+              run: scripts/checkout_submodules.py --configure --shallow --platform tizen
 
             - name: Bootstrap cache
               uses: actions/cache@v3
diff --git a/.github/workflows/full-android.yaml b/.github/workflows/full-android.yaml
index d28d3fb1679b2d..a932c94ec537b8 100644
--- a/.github/workflows/full-android.yaml
+++ b/.github/workflows/full-android.yaml
@@ -61,7 +61,7 @@ jobs:
               if: ${{ env.ACT }}
               name: Checkout (ACT for local build)
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform android
+              run: scripts/checkout_submodules.py --configure --shallow --platform android
 
             - name: Bootstrap cache
               uses: actions/cache@v3
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index caac210d7dfa91..da38ef50a49cc6 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -54,7 +54,7 @@ jobs:
             # Bootstrap and checkout for internal scripts (like idl_lint)
             # to run
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
             - name: Bootstrap cache
               uses: actions/cache@v3
               timeout-minutes: 10
diff --git a/.github/workflows/qemu.yaml b/.github/workflows/qemu.yaml
index c91e378691d976..53f2cb66b57049 100644
--- a/.github/workflows/qemu.yaml
+++ b/.github/workflows/qemu.yaml
@@ -53,7 +53,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform esp32
+              run: scripts/checkout_submodules.py --configure --shallow --platform esp32
 
             - name: Bootstrap cache
               uses: actions/cache@v3
@@ -117,7 +117,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform tizen
+              run: scripts/checkout_submodules.py --configure --shallow --platform tizen
 
             - name: Bootstrap cache
               uses: actions/cache@v3
diff --git a/.github/workflows/smoketest-android.yaml b/.github/workflows/smoketest-android.yaml
index 90987df038cb79..d2399118b1b676 100644
--- a/.github/workflows/smoketest-android.yaml
+++ b/.github/workflows/smoketest-android.yaml
@@ -52,7 +52,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform android
+              run: scripts/checkout_submodules.py --configure --shallow --platform android
 
             - name: Bootstrap cache
               uses: actions/cache@v3
diff --git a/.github/workflows/smoketest-darwin.yaml b/.github/workflows/smoketest-darwin.yaml
index d4b06f4f2d3c89..78f11166a4ec1a 100644
--- a/.github/workflows/smoketest-darwin.yaml
+++ b/.github/workflows/smoketest-darwin.yaml
@@ -42,7 +42,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform darwin
+              run: scripts/checkout_submodules.py --configure --shallow --platform darwin
             - name: Setup Environment
               run: brew install python@3.9
 
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 2eda3b67aa45fd..c26d47f56ed134 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -72,7 +72,7 @@ jobs:
               if: ${{ env.ACT }}
               name: Checkout (ACT for local build)
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
             - name: Try to ensure the directories for core dumping exist and we
                   can write them.
               run: |
@@ -324,7 +324,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform darwin
+              run: scripts/checkout_submodules.py --configure --shallow --platform darwin
             - name: Setup Environment
               # coreutils for stdbuf
               run: brew install coreutils
@@ -450,7 +450,7 @@ jobs:
             - name: Checkout
               uses: actions/checkout@v3
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
             - name: Try to ensure the directories for core dumping exist and we
                   can write them.
               run: |
@@ -536,7 +536,7 @@ jobs:
             - name: Checkout
               uses: actions/checkout@v3
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
             - name: Try to ensure the directories for core dumping exist and we
                   can write them.
               run: |
@@ -705,7 +705,7 @@ jobs:
             - name: Checkout
               uses: actions/checkout@v3
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform darwin
+              run: scripts/checkout_submodules.py --configure --shallow --platform darwin
             - name: Setup Environment
               # coreutils for stdbuf
               run: brew install coreutils
diff --git a/.github/workflows/unit_integration_test.yaml b/.github/workflows/unit_integration_test.yaml
index 540e4a9563f283..d765e40f68254e 100644
--- a/.github/workflows/unit_integration_test.yaml
+++ b/.github/workflows/unit_integration_test.yaml
@@ -53,7 +53,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
             - name: Bootstrap
               timeout-minutes: 10
               run: |
diff --git a/.github/workflows/zap_regeneration.yaml b/.github/workflows/zap_regeneration.yaml
index 257b86e81914a7..803dc04c0b978d 100644
--- a/.github/workflows/zap_regeneration.yaml
+++ b/.github/workflows/zap_regeneration.yaml
@@ -45,7 +45,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
 
             - name: Bootstrap cache
               uses: actions/cache@v3
diff --git a/.github/workflows/zap_templates.yaml b/.github/workflows/zap_templates.yaml
index d1a846b9968cb0..7a4b281dd6e963 100644
--- a/.github/workflows/zap_templates.yaml
+++ b/.github/workflows/zap_templates.yaml
@@ -46,7 +46,7 @@ jobs:
                   attempt_limit: 3
                   attempt_delay: 2000
             - name: Checkout submodules
-              run: scripts/checkout_submodules.py --shallow --platform linux
+              run: scripts/checkout_submodules.py --configure --shallow --platform linux
 
             - name: Bootstrap cache
               uses: actions/cache@v3
diff --git a/examples/chef/README.md b/examples/chef/README.md
index 52829c0500a079..a0308ab2d277bb 100644
--- a/examples/chef/README.md
+++ b/examples/chef/README.md
@@ -146,7 +146,7 @@ chef_$PLATFORM:
               attempt_limit: 3
               attempt_delay: 2000
         - name: Checkout submodules
-          run: scripts/checkout_submodules.py --shallow --platform $PLATFORM
+          run: scripts/checkout_submodules.py --configure --shallow --platform $PLATFORM
         - name: Bootstrap
           timeout-minutes: 25
           run: scripts/build/gn_bootstrap.sh
diff --git a/integrations/docker/images/chip-cert-bins/Dockerfile b/integrations/docker/images/chip-cert-bins/Dockerfile
index cef22b4e632eea..6866f09e3ebf96 100644
--- a/integrations/docker/images/chip-cert-bins/Dockerfile
+++ b/integrations/docker/images/chip-cert-bins/Dockerfile
@@ -11,22 +11,22 @@ ARG ZAP_VERSION=v2023.03.23-nightly
 
 # Ensure TARGETPLATFORM is set
 RUN case ${TARGETPLATFORM} in \
-        "linux/amd64") \
-            echo "Building for linux/amd64" \
-        ;; \
-        "linux/arm64") \
-            echo "Building for linux/arm64" \
-        ;; \
-        *) \
-        if [ -z "$TARGETPLATFORM" ] ;\
-        then \
-            echo "TARGETPLATFORM not defined! Please run from buildkit (buildx)." \
-        && return 1 ;\
-        else \
-            echo "Unsupported platform ${TARGETPLATFORM}." \
-        && return 1 ;\
-        fi \
-        ;; \
+    "linux/amd64") \
+    echo "Building for linux/amd64" \
+    ;; \
+    "linux/arm64") \
+    echo "Building for linux/arm64" \
+    ;; \
+    *) \
+    if [ -z "$TARGETPLATFORM" ] ;\
+    then \
+    echo "TARGETPLATFORM not defined! Please run from buildkit (buildx)." \
+    && return 1 ;\
+    else \
+    echo "Unsupported platform ${TARGETPLATFORM}." \
+    && return 1 ;\
+    fi \
+    ;; \
     esac
 
 # Below should be the same as chip-build except arm64 logic for cmake and node.
@@ -96,25 +96,25 @@ RUN set -x \
 
 # Cmake (Mbed OS requires >=3.19.0-rc3 version which is not available in Ubuntu 20.04 repository)
 RUN case ${TARGETPLATFORM} in \
-        "linux/amd64") \
-            set -x \
-            && (cd /tmp \
-            && wget --progress=dot:giga https://github.com/Kitware/CMake/releases/download/v3.19.3/cmake-3.19.3-Linux-x86_64.sh \
-            && sh cmake-3.19.3-Linux-x86_64.sh --exclude-subdir --prefix=/usr/local \
-            && rm -rf cmake-3.19.3-Linux-x86_64.sh) \
-            && exec bash \
-            ;; \
-        "linux/arm64") \
-            set -x \
-            && (cd /tmp \
-            && wget --progress=dot:giga https://github.com/Kitware/CMake/releases/download/v3.19.3/cmake-3.19.3-Linux-aarch64.sh \
-            && sh cmake-3.19.3-Linux-aarch64.sh --exclude-subdir --prefix=/usr/local \
-            && rm -rf cmake-3.19.3-Linux-aarch64.sh) \
-            && exec bash \
-            ;; \
-        *) \
-        test -n "$TARGETPLATFORM" \
-        echo "Unsupported platform ${TARGETPLATFORM}" \
+    "linux/amd64") \
+    set -x \
+    && (cd /tmp \
+    && wget --progress=dot:giga https://github.com/Kitware/CMake/releases/download/v3.19.3/cmake-3.19.3-Linux-x86_64.sh \
+    && sh cmake-3.19.3-Linux-x86_64.sh --exclude-subdir --prefix=/usr/local \
+    && rm -rf cmake-3.19.3-Linux-x86_64.sh) \
+    && exec bash \
+    ;; \
+    "linux/arm64") \
+    set -x \
+    && (cd /tmp \
+    && wget --progress=dot:giga https://github.com/Kitware/CMake/releases/download/v3.19.3/cmake-3.19.3-Linux-aarch64.sh \
+    && sh cmake-3.19.3-Linux-aarch64.sh --exclude-subdir --prefix=/usr/local \
+    && rm -rf cmake-3.19.3-Linux-aarch64.sh) \
+    && exec bash \
+    ;; \
+    *) \
+    test -n "$TARGETPLATFORM" \
+    echo "Unsupported platform ${TARGETPLATFORM}" \
     ;; \
     esac
 
@@ -159,31 +159,31 @@ RUN set -x \
 # NodeJS: install a newer version than what apt-get would read
 # This installs the latest LTS version of nodejs
 RUN case ${TARGETPLATFORM} in \
-        "linux/amd64") \
-            set -x \
-            && mkdir node_js \
-            && cd node_js \
-            && wget https://nodejs.org/dist/v12.22.12/node-v12.22.12-linux-x64.tar.xz \
-            && tar xfvJ node-v12.22.12-linux-x64.tar.xz \
-            && mv node-v12.22.12-linux-x64 /opt/ \
-            && ln -s /opt/node-v12.22.12-linux-x64 /opt/node \
-            && ln -s /opt/node/bin/* /usr/bin \
-            && cd .. \
-            && rm -rf node_js \
-            ;; \
-        "linux/arm64")\
-            set -x \
-            && mkdir node_js \
-            && cd node_js \
-            && wget https://nodejs.org/dist/v12.22.12/node-v12.22.12-linux-arm64.tar.xz \
-            && tar xfvJ node-v12.22.12-linux-arm64.tar.xz \
-            && mv node-v12.22.12-linux-arm64 /opt/ \
-            && ln -s /opt/node-v12.22.12-linux-arm64 /opt/node \
-            && ln -s /opt/node/bin/* /usr/bin \
-            && cd .. \
-            && rm -rf node_js \
-            ;; \
-        *) ;; \
+    "linux/amd64") \
+    set -x \
+    && mkdir node_js \
+    && cd node_js \
+    && wget https://nodejs.org/dist/v12.22.12/node-v12.22.12-linux-x64.tar.xz \
+    && tar xfvJ node-v12.22.12-linux-x64.tar.xz \
+    && mv node-v12.22.12-linux-x64 /opt/ \
+    && ln -s /opt/node-v12.22.12-linux-x64 /opt/node \
+    && ln -s /opt/node/bin/* /usr/bin \
+    && cd .. \
+    && rm -rf node_js \
+    ;; \
+    "linux/arm64")\
+    set -x \
+    && mkdir node_js \
+    && cd node_js \
+    && wget https://nodejs.org/dist/v12.22.12/node-v12.22.12-linux-arm64.tar.xz \
+    && tar xfvJ node-v12.22.12-linux-arm64.tar.xz \
+    && mv node-v12.22.12-linux-arm64 /opt/ \
+    && ln -s /opt/node-v12.22.12-linux-arm64 /opt/node \
+    && ln -s /opt/node/bin/* /usr/bin \
+    && cd .. \
+    && rm -rf node_js \
+    ;; \
+    *) ;; \
     esac
 
 RUN set -x \
@@ -200,7 +200,7 @@ RUN mkdir /root/connectedhomeip
 RUN git clone https://github.com/project-chip/connectedhomeip.git /root/connectedhomeip
 WORKDIR /root/connectedhomeip/
 RUN git checkout ${COMMITHASH}
-RUN ./scripts/checkout_submodules.py --shallow --platform linux
+RUN ./scripts/checkout_submodules.py --configure --shallow --platform linux
 RUN scripts/build/gn_bootstrap.sh
 SHELL ["/bin/bash", "-c"]
 RUN set -x && \
@@ -217,63 +217,63 @@ SHELL ["/bin/bash", "-c"]
 RUN git rev-parse HEAD > /root/.sdk-sha-version
 
 RUN case ${TARGETPLATFORM} in \
-        "linux/amd64") \
-            set -x \
-            && source scripts/activate.sh \
-            && scripts/build/build_examples.py \
-            --target linux-x64-all-clusters-ipv6only \
-            --target linux-x64-all-clusters-minimal-ipv6only \
-            --target linux-x64-bridge-ipv6only \
-            --target linux-x64-tv-app-ipv6only \
-            --target linux-x64-tv-casting-app-ipv6only \
-            --target linux-x64-light-ipv6only \
-            --target linux-x64-thermostat-ipv6only \
-            --target linux-x64-ota-provider-ipv6only \
-            --target linux-x64-ota-requestor-ipv6only \
-            --target linux-x64-lock-ipv6only \
-            --target linux-x64-simulated-app1-ipv6only \
-            build \
-            && mv out/linux-x64-all-clusters-ipv6only/chip-all-clusters-app out/chip-all-clusters-app \
-            && mv out/linux-x64-all-clusters-minimal-ipv6only/chip-all-clusters-minimal-app out/chip-all-clusters-minimal-app \
-            && mv out/linux-x64-bridge-ipv6only/chip-bridge-app out/chip-bridge-app \
-            && mv out/linux-x64-tv-app-ipv6only/chip-tv-app out/chip-tv-app \
-            && mv out/linux-x64-tv-casting-app-ipv6only/chip-tv-casting-app out/chip-tv-casting-app \
-            && mv out/linux-x64-light-ipv6only/chip-lighting-app out/chip-lighting-app \
-            && mv out/linux-x64-thermostat-ipv6only/thermostat-app out/thermostat-app \
-            && mv out/linux-x64-ota-provider-ipv6only/chip-ota-provider-app out/chip-ota-provider-app \
-            && mv out/linux-x64-ota-requestor-ipv6only/chip-ota-requestor-app out/chip-ota-requestor-app \
-            && mv out/linux-x64-lock-ipv6only/chip-lock-app out/chip-lock-app \
-            && mv out/linux-x64-simulated-app1-ipv6only/chip-app1 out/chip-app1 \
-                ;; \
-        "linux/arm64")\
-            set -x \
-            && source scripts/activate.sh \
-            && scripts/build/build_examples.py \
-            --target linux-arm64-all-clusters-ipv6only \
-            --target linux-arm64-all-clusters-minimal-ipv6only \
-            --target linux-arm64-bridge-ipv6only \
-            --target linux-arm64-tv-app-ipv6only \
-            --target linux-arm64-tv-casting-app-ipv6only \
-            --target linux-arm64-light-ipv6only \
-            --target linux-arm64-thermostat-ipv6only \
-            --target linux-arm64-ota-provider-ipv6only \
-            --target linux-arm64-ota-requestor-ipv6only \
-            --target linux-arm64-lock-ipv6only \
-            --target linux-arm64-simulated-app1-ipv6only \
-            build \
-            && mv out/linux-arm64-all-clusters-ipv6only/chip-all-clusters-app out/chip-all-clusters-app \
-            && mv out/linux-arm64-all-clusters-minimal-ipv6only/chip-all-clusters-minimal-app out/chip-all-clusters-minimal-app \
-            && mv out/linux-arm64-bridge-ipv6only/chip-bridge-app out/chip-bridge-app \
-            && mv out/linux-arm64-tv-app-ipv6only/chip-tv-app out/chip-tv-app \
-            && mv out/linux-arm64-tv-casting-app-ipv6only/chip-tv-casting-app out/chip-tv-casting-app \
-            && mv out/linux-arm64-light-ipv6only/chip-lighting-app out/chip-lighting-app \
-            && mv out/linux-arm64-thermostat-ipv6only/thermostat-app out/thermostat-app \
-            && mv out/linux-arm64-ota-provider-ipv6only/chip-ota-provider-app out/chip-ota-provider-app \
-            && mv out/linux-arm64-ota-requestor-ipv6only/chip-ota-requestor-app out/chip-ota-requestor-app \
-            && mv out/linux-arm64-lock-ipv6only/chip-lock-app out/chip-lock-app \
-            && mv out/linux-arm64-simulated-app1-ipv6only/chip-app1 out/chip-app1 \
-            ;; \
-        *) ;; \
+    "linux/amd64") \
+    set -x \
+    && source scripts/activate.sh \
+    && scripts/build/build_examples.py \
+    --target linux-x64-all-clusters-ipv6only \
+    --target linux-x64-all-clusters-minimal-ipv6only \
+    --target linux-x64-bridge-ipv6only \
+    --target linux-x64-tv-app-ipv6only \
+    --target linux-x64-tv-casting-app-ipv6only \
+    --target linux-x64-light-ipv6only \
+    --target linux-x64-thermostat-ipv6only \
+    --target linux-x64-ota-provider-ipv6only \
+    --target linux-x64-ota-requestor-ipv6only \
+    --target linux-x64-lock-ipv6only \
+    --target linux-x64-simulated-app1-ipv6only \
+    build \
+    && mv out/linux-x64-all-clusters-ipv6only/chip-all-clusters-app out/chip-all-clusters-app \
+    && mv out/linux-x64-all-clusters-minimal-ipv6only/chip-all-clusters-minimal-app out/chip-all-clusters-minimal-app \
+    && mv out/linux-x64-bridge-ipv6only/chip-bridge-app out/chip-bridge-app \
+    && mv out/linux-x64-tv-app-ipv6only/chip-tv-app out/chip-tv-app \
+    && mv out/linux-x64-tv-casting-app-ipv6only/chip-tv-casting-app out/chip-tv-casting-app \
+    && mv out/linux-x64-light-ipv6only/chip-lighting-app out/chip-lighting-app \
+    && mv out/linux-x64-thermostat-ipv6only/thermostat-app out/thermostat-app \
+    && mv out/linux-x64-ota-provider-ipv6only/chip-ota-provider-app out/chip-ota-provider-app \
+    && mv out/linux-x64-ota-requestor-ipv6only/chip-ota-requestor-app out/chip-ota-requestor-app \
+    && mv out/linux-x64-lock-ipv6only/chip-lock-app out/chip-lock-app \
+    && mv out/linux-x64-simulated-app1-ipv6only/chip-app1 out/chip-app1 \
+    ;; \
+    "linux/arm64")\
+    set -x \
+    && source scripts/activate.sh \
+    && scripts/build/build_examples.py \
+    --target linux-arm64-all-clusters-ipv6only \
+    --target linux-arm64-all-clusters-minimal-ipv6only \
+    --target linux-arm64-bridge-ipv6only \
+    --target linux-arm64-tv-app-ipv6only \
+    --target linux-arm64-tv-casting-app-ipv6only \
+    --target linux-arm64-light-ipv6only \
+    --target linux-arm64-thermostat-ipv6only \
+    --target linux-arm64-ota-provider-ipv6only \
+    --target linux-arm64-ota-requestor-ipv6only \
+    --target linux-arm64-lock-ipv6only \
+    --target linux-arm64-simulated-app1-ipv6only \
+    build \
+    && mv out/linux-arm64-all-clusters-ipv6only/chip-all-clusters-app out/chip-all-clusters-app \
+    && mv out/linux-arm64-all-clusters-minimal-ipv6only/chip-all-clusters-minimal-app out/chip-all-clusters-minimal-app \
+    && mv out/linux-arm64-bridge-ipv6only/chip-bridge-app out/chip-bridge-app \
+    && mv out/linux-arm64-tv-app-ipv6only/chip-tv-app out/chip-tv-app \
+    && mv out/linux-arm64-tv-casting-app-ipv6only/chip-tv-casting-app out/chip-tv-casting-app \
+    && mv out/linux-arm64-light-ipv6only/chip-lighting-app out/chip-lighting-app \
+    && mv out/linux-arm64-thermostat-ipv6only/thermostat-app out/thermostat-app \
+    && mv out/linux-arm64-ota-provider-ipv6only/chip-ota-provider-app out/chip-ota-provider-app \
+    && mv out/linux-arm64-ota-requestor-ipv6only/chip-ota-requestor-app out/chip-ota-requestor-app \
+    && mv out/linux-arm64-lock-ipv6only/chip-lock-app out/chip-lock-app \
+    && mv out/linux-arm64-simulated-app1-ipv6only/chip-app1 out/chip-app1 \
+    ;; \
+    *) ;; \
     esac
 
 RUN source scripts/activate.sh && scripts/build_python.sh -m platform -d true -i no
diff --git a/scripts/build/gn_gen_cirque.sh b/scripts/build/gn_gen_cirque.sh
index 85da0c232745c5..b7970256917819 100755
--- a/scripts/build/gn_gen_cirque.sh
+++ b/scripts/build/gn_gen_cirque.sh
@@ -30,7 +30,7 @@ env
 cd "$ROOT_PATH"
 
 echo "Ensure submodules for Linux builds are checked out"
-./scripts/checkout_submodules.py --shallow --platform linux
+./scripts/checkout_submodules.py --configure --shallow --platform linux
 
 echo "Setup build environment"
 source "./scripts/activate.sh"
diff --git a/scripts/checkout_submodules.py b/scripts/checkout_submodules.py
index 55da322e8184b0..b75c5fa40d2dd7 100755
--- a/scripts/checkout_submodules.py
+++ b/scripts/checkout_submodules.py
@@ -78,7 +78,10 @@ def module_initialized(module: Module) -> bool:
 
 def make_chip_root_safe_directory() -> None:
     # ensure no errors regarding ownership in the directory. Newer GIT seems to require this:
-    subprocess.check_call(['git', 'config', '--global', '--add', 'safe.directory', CHIP_ROOT])
+    existing = subprocess.check_output(['git', 'config', '--global', '--get-all', 'safe.directory'], text=True).split('\n')
+    if CHIP_ROOT not in existing:
+        logging.info("Adding CHIP_ROOT to git safe.directory configuration")
+        subprocess.check_call(['git', 'config', '--global', '--add', 'safe.directory', CHIP_ROOT])
 
 
 def checkout_modules(modules: list, shallow: bool, force: bool, recursive: bool) -> None:
@@ -109,6 +112,7 @@ def main():
     logging.basicConfig(format='%(message)s', level=logging.INFO)
 
     parser = argparse.ArgumentParser(description='Checkout or update relevant git submodules')
+    parser.add_argument('--configure', action='store_true', help='Configure global git options if necessary, e.g. safe.directory')
     parser.add_argument('--shallow', action='store_true', help='Fetch submodules without history')
     parser.add_argument('--platform', nargs='+', choices=ALL_PLATFORMS, default=[],
                         help='Process submodules for specific platforms only')
@@ -124,7 +128,8 @@ def main():
     unmatched_modules = [m for m in modules if not module_matches_platforms(
         m, selected_platforms) and module_initialized(m)]
 
-    make_chip_root_safe_directory()
+    if args.configure:
+        make_chip_root_safe_directory()
     checkout_modules(selected_modules, args.shallow, args.force, args.recursive)
 
     if args.deinit_unmatched and unmatched_modules: