diff --git a/scripts/tests/test_docs_only_detector_clone_depth.py b/scripts/tests/test_docs_only_detector_clone_depth.py
index 1855715fc..5c6053d83 100644
--- a/scripts/tests/test_docs_only_detector_clone_depth.py
+++ b/scripts/tests/test_docs_only_detector_clone_depth.py
@@ -52,20 +52,53 @@ def _env(**extra: str) -> dict[str, str]:
     which arm it takes. Pinning only the one variable that bites today would leave the class open for
     the next arm that starts reading a sibling — the whole prefix goes, and `_run_detector` puts back
     exactly what each test means to set.
+
+    THE MACHINE'S GIT CONFIG IS NEUTRALISED TOO, and that is not belt-and-braces — it is what keeps
+    this file from passing here and failing in CI. A developer checkout has a global `user.email`;
+    the CI container has none, and git refuses to commit without one ("Author identity unknown").
+    The fixtures below commit, so the first version of this file was green locally and red in CI on
+    exactly that. Pointing the global and system config at `os.devnull` makes the ambient
+    configuration UNAVAILABLE rather than merely overridden, so a missing `-c` flag in `_git` fails
+    everywhere instead of only where the machine is unhelpful — the local run reproduces CI by
+    construction. It also disarms a global `core.hooksPath` (which would fire this repo's husky
+    hooks against throwaway fixtures) and a global `commit.gpgsign` (which would block on a pinentry
+    prompt no pytest timeout is watching).
     """
     env = {k: v for k, v in os.environ.items() if not k.startswith(("GIT_", "GITHUB_"))}
+    env["GIT_CONFIG_GLOBAL"] = os.devnull
+    env["GIT_CONFIG_SYSTEM"] = os.devnull
     env.update(extra)
     return env
 
 
+# Passed to every git invocation, so no repository here can inherit an identity or a hook path from
+# the machine. `_env()` makes the ambient config unavailable; these supply what the commits need.
+_GIT_CONF = [
+    "-c",
+    "user.email=test@example.com",
+    "-c",
+    "user.name=Test",
+    "-c",
+    "commit.gpgsign=false",
+    "-c",
+    "core.hooksPath=",
+    # Forbids git from INVENTING an identity from the OS user and hostname. Without it the two
+    # settings above are not enough to reproduce CI: a Mac happily auto-detects one, so dropping the
+    # identity flags stays green locally and fails in the container. With it, a missing flag fails
+    # everywhere — verified by removing the identity pair and watching this file go red.
+    "-c",
+    "user.useConfigOnly=true",
+]
+
+
 def _git(args: list[str], cwd: Path) -> str:
-    r = subprocess.run(["git", *args], cwd=str(cwd), env=_env(), capture_output=True, text=True)
+    r = subprocess.run(["git", *_GIT_CONF, *args], cwd=str(cwd), env=_env(), capture_output=True, text=True)
     assert r.returncode == 0, f"git {' '.join(args)} failed: {r.stderr}"
     return r.stdout.strip()
 
 
 def _git_rc(args: list[str], cwd: Path) -> subprocess.CompletedProcess:
-    return subprocess.run(["git", *args], cwd=str(cwd), env=_env(), capture_output=True, text=True)
+    return subprocess.run(["git", *_GIT_CONF, *args], cwd=str(cwd), env=_env(), capture_output=True, text=True)
 
 
 def _is_shallow(repo: Path) -> str:
@@ -84,8 +117,6 @@ def origin_url(tmp_path_factory) -> str:
     origin = root / "origin"
     origin.mkdir()
     _git(["init", "-q", "-b", "main", "."], origin)
-    _git(["config", "user.email", "test@example.com"], origin)
-    _git(["config", "user.name", "Test"], origin)
 
     for i in range(1, 13):
         (origin / f"f{i}.txt").write_text(f"{i}\n")
@@ -123,8 +154,6 @@ def deep_origin_url(tmp_path_factory) -> str:
     origin = root / "origin"
     origin.mkdir()
     _git(["init", "-q", "-b", "main", "."], origin)
-    _git(["config", "user.email", "test@example.com"], origin)
-    _git(["config", "user.name", "Test"], origin)
     (origin / "a.txt").write_text("a\n")
     _git(["add", "-A"], origin)
     _git(["commit", "-q", "-m", "c0"], origin)