diff --git a/deploy/update-test-server.sh b/deploy/update-test-server.sh
index cf234c4..85f0c46 100755
--- a/deploy/update-test-server.sh
+++ b/deploy/update-test-server.sh
@@ -9,6 +9,17 @@ PROJECT_ROOT=${PROJECT_ROOT:-$(dirname -- "$SCRIPT_DIR")}
 DEPLOY_OWNER=${DEPLOY_OWNER:-www-data:www-data}
 LOCK_FILE=${LOCK_FILE:-/tmp/ktrix-test-update.lock}
 
+# Composer and npm can invoke Git themselves, bypassing git_in(). Pass the
+# deployment exceptions to every child Git process without changing global
+# Git configuration.
+GIT_CONFIG_COUNT=2
+GIT_CONFIG_KEY_0=safe.directory
+GIT_CONFIG_VALUE_0=$PROJECT_ROOT
+GIT_CONFIG_KEY_1=safe.directory
+GIT_CONFIG_VALUE_1=$PROJECT_ROOT/modules/*
+export GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
+export GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1
+
 log()
 {
     printf '%s %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*"