diff --git a/infrastructure/cicd/tekton-helm/templates/task-detect-changes.yaml b/infrastructure/cicd/tekton-helm/templates/task-detect-changes.yaml
index b7d9afd2..8cc9392f 100644
--- a/infrastructure/cicd/tekton-helm/templates/task-detect-changes.yaml
+++ b/infrastructure/cicd/tekton-helm/templates/task-detect-changes.yaml
@@ -32,6 +32,9 @@ spec:
         #!/bin/bash
         set -e
 
+        # Mark workspace as safe directory to avoid ownership issues
+        git config --global --add safe.directory "$(workspaces.source.path)"
+
         cd $(workspaces.source.path)
 
         # Get the list of changed files
diff --git a/infrastructure/cicd/tekton-helm/templates/task-git-clone.yaml b/infrastructure/cicd/tekton-helm/templates/task-git-clone.yaml
index 36a6eb2b..bd54ea0c 100644
--- a/infrastructure/cicd/tekton-helm/templates/task-git-clone.yaml
+++ b/infrastructure/cicd/tekton-helm/templates/task-git-clone.yaml
@@ -59,6 +59,9 @@ spec:
         echo "Depth: $DEPTH"
         echo "============================================"
 
+        # Mark workspace as safe directory to avoid ownership issues
+        git config --global --add safe.directory "$OUTPUT_PATH"
+
         # Clone with depth for faster checkout
         if [ "$DEPTH" = "0" ]; then
           echo "Cloning full repository..."
diff --git a/infrastructure/cicd/tekton-helm/templates/task-update-gitops.yaml b/infrastructure/cicd/tekton-helm/templates/task-update-gitops.yaml
index 10fd7bd8..af63f7a1 100644
--- a/infrastructure/cicd/tekton-helm/templates/task-update-gitops.yaml
+++ b/infrastructure/cicd/tekton-helm/templates/task-update-gitops.yaml
@@ -72,6 +72,9 @@ spec:
         # Configure git
         git config --global user.email "ci@bakery-ia.local"
         git config --global user.name "bakery-ia-ci"
+        # Mark directories as safe to avoid ownership issues
+        git config --global --add safe.directory /tmp/gitops
+        git config --global --add safe.directory "$(workspaces.source.path)"
 
         # Clone the main repository (not a separate gitops repo)
         # Use internal cluster DNS which works in all environments