diff --git a/Jenkinsfile b/Jenkinsfile
index 32a9c249..39219710 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -273,12 +273,21 @@ PY
       steps {
         withCredentials([usernamePassword(credentialsId: 'gitea-pat', usernameVariable: 'GIT_USER', passwordVariable: 'GIT_TOKEN')]) {
           sh '''
-            set +x
-            cd "${WORKSPACE}"
-            if [ ! -d .git ]; then
+            set -euo pipefail
+            if ! command -v git >/dev/null 2>&1; then
+              if command -v apk >/dev/null 2>&1; then
+                apk add --no-cache git >/dev/null
+              elif command -v apt-get >/dev/null 2>&1; then
+                apt-get update >/dev/null
+                apt-get install -y git >/dev/null
+              fi
+            fi
+            cd "${WORKSPACE:-$PWD}"
+            if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
               echo "workspace is not a git checkout; skipping promote"
               exit 0
             fi
+            set +x
             git config user.email "jenkins@bstein.dev"
             git config user.name "jenkins"
             git remote set-url origin https://${GIT_USER}:${GIT_TOKEN}@scm.bstein.dev/bstein/titan-iac.git
diff --git a/ci/Jenkinsfile.titan-iac b/ci/Jenkinsfile.titan-iac
index aa435064..8d83bfa8 100644
--- a/ci/Jenkinsfile.titan-iac
+++ b/ci/Jenkinsfile.titan-iac
@@ -272,12 +272,21 @@ PY
       steps {
         withCredentials([usernamePassword(credentialsId: 'gitea-pat', usernameVariable: 'GIT_USER', passwordVariable: 'GIT_TOKEN')]) {
           sh '''
-            set +x
-            cd "${WORKSPACE}"
-            if [ ! -d .git ]; then
+            set -euo pipefail
+            if ! command -v git >/dev/null 2>&1; then
+              if command -v apk >/dev/null 2>&1; then
+                apk add --no-cache git >/dev/null
+              elif command -v apt-get >/dev/null 2>&1; then
+                apt-get update >/dev/null
+                apt-get install -y git >/dev/null
+              fi
+            fi
+            cd "${WORKSPACE:-$PWD}"
+            if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
               echo "workspace is not a git checkout; skipping promote"
               exit 0
             fi
+            set +x
             git config user.email "jenkins@bstein.dev"
             git config user.name "jenkins"
             git remote set-url origin https://${GIT_USER}:${GIT_TOKEN}@scm.bstein.dev/bstein/titan-iac.git