diff --git a/monitor/service_release.py b/monitor/service_release.py
index 64208fe..1fd6d1a 100644
--- a/monitor/service_release.py
+++ b/monitor/service_release.py
@@ -379,6 +379,19 @@ def build_cache_root(repo_root: Path) -> Path:
     return ROOT / "run" / "build_cache"
 
 
+def repo_origin_url(repo_root: Path, label: str) -> str:
+    # 固定构建工作区优先直接连 origin，避免本地源码仓 owner 不一致触发 safe.directory。
+    try:
+        return local_command_output(
+            ["git", "-C", str(repo_root), "remote", "get-url", "origin"],
+            cwd=repo_root,
+            label=f"{label} get origin url",
+            timeout_seconds=120,
+        )
+    except Exception:  # noqa: BLE001
+        return str(repo_root)
+
+
 def persistent_build_workspace_path(repo_root: Path, git_ref: str) -> Path:
     # 同一仓库同一 ref 固定复用一份构建目录，最大化保留 target 缓存。
     return build_cache_root(repo_root) / repo_root.name / sanitized_ref_fragment(git_ref)
@@ -395,33 +408,20 @@ def prepare_persistent_build_workspace(
     # 固定构建工作区是专用缓存目录，允许 reset --hard 到目标提交。
     workspace_root = persistent_build_workspace_path(repo_root, git_ref)
     workspace_root.parent.mkdir(parents=True, exist_ok=True)
-
-    # 源仓有时由别的用户维护，git clone 本地路径前先显式加入 safe.directory。
-    local_command_output(
-        ["git", "config", "--global", "--add", "safe.directory", str(repo_root)],
-        cwd=workspace_root.parent,
-        label=f"{label} allow source repo",
-        timeout_seconds=120,
-    )
-    local_command_output(
-        ["git", "config", "--global", "--add", "safe.directory", str(repo_root / '.git')],
-        cwd=workspace_root.parent,
-        label=f"{label} allow source repo dotgit",
-        timeout_seconds=120,
-    )
+    origin_url = repo_origin_url(repo_root, label)
 
     if not (workspace_root / ".git").exists():
         if workspace_root.exists():
             shutil.rmtree(workspace_root, ignore_errors=True)
         local_command_output(
-            ["git", "clone", "--no-checkout", str(repo_root), str(workspace_root)],
+            ["git", "clone", "--no-checkout", origin_url, str(workspace_root)],
             cwd=workspace_root.parent,
             label=f"{label} clone build workspace",
             timeout_seconds=600,
         )
 
     local_command_output(
-        ["git", "-C", str(workspace_root), "remote", "set-url", "origin", str(repo_root)],
+        ["git", "-C", str(workspace_root), "remote", "set-url", "origin", origin_url],
         cwd=workspace_root,
         label=f"{label} set build workspace origin",
         timeout_seconds=120,