diff --git a/.github/workflows/deploy-docs-versioned.yml b/.github/workflows/deploy-docs-versioned.yml
index 48022f1..7400be1 100644
--- a/.github/workflows/deploy-docs-versioned.yml
+++ b/.github/workflows/deploy-docs-versioned.yml
@@ -26,6 +26,9 @@ jobs:
           fetch-depth: 0
           submodules: recursive
 
+      - name: Mark workspace as safe for Git
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Stage cuvis.h for Doxygen
         run: |
           mkdir -p docs/_api_sources
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index f603dd4..f7201d0 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -25,6 +25,9 @@ jobs:
           fetch-depth: 0
           submodules: recursive
 
+      - name: Mark workspace as safe for Git
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - name: Stage cuvis.h for Doxygen
         run: |
           mkdir -p docs/_api_sources
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fb6f0e9..f5c09da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- **CI: fixed the docs deploy failing in-container.** Added `git config --global --add safe.directory "$GITHUB_WORKSPACE"` after checkout in both deploy workflows; without it git rejected the container-checked-out workspace (`fatal: not in a git directory`), so the `mike` deploy could never push to `gh-pages`.
 - **Documentation site migrated into this repo** (from `cuvis.doc`) and published to GitHub Pages. Versioned with `mike`: pushing a `v*.*.*` tag publishes that version aliased to `latest` (`deploy-docs-versioned.yml`), and pushes to `main` publish a `dev` build (`deploy-docs.yml`). C and C++ API reference generated from the headers via `mkdoxy` (Doxygen XML), Python API reference via `mkdocstrings`, example pages generated from the Python notebooks, and an `llms.txt` / `llms-full.txt` index via `mkdocs-llmstxt`.
 - Rebranded the mkdocs site to follow Cubert CI. Switched the Material `palette` to `primary/accent: custom` and let `docs/stylesheets/extra.css` drive the palette directly across both Material schemes. Headings use Rajdhani via a Google Fonts `@import`; body and code stay on Roboto / Roboto Mono via Material's font loader. Existing `.sdk-installer` widget styles are preserved on top of the brand palette.
 - **CI: restored a strict docs build gate.** Added a `Docs build check` workflow (`.github/workflows/docs-check.yml`) that runs `mkdocs build --strict` on pull requests, plus a strict build step ahead of `mike deploy` in both the nightly and versioned deploy workflows, so dead links or missing generated pages fail CI instead of publishing a broken site.