diff --git a/functions-common b/functions-common
index ddef2e4980..8651604b79 100644
--- a/functions-common
+++ b/functions-common
@@ -677,8 +677,13 @@ function git_clone {
     # about how we clone and work with repos.  Mark them safe globally
     # as a work-around.
     #
+    # NOTE(danms): On bionic (and likely others) git-config may write
+    # ~stackuser/.gitconfig if not run with sudo -H. Using --system
+    # writes these changes to /etc/gitconfig which is more
+    # discoverable anyway.
+    #
     # [1] https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9
-    sudo git config --global --add safe.directory ${git_dest}
+    sudo git config --system --add safe.directory ${git_dest}
 
     # print out the results so we know what change was used in the logs
     cd $git_dest
diff --git a/unstack.sh b/unstack.sh
index 4b57b6e344..813f9a8117 100755
--- a/unstack.sh
+++ b/unstack.sh
@@ -181,3 +181,8 @@ fi
 
 clean_pyc_files
 rm -Rf $DEST/async
+
+# Clean any safe.directory items we wrote into the global
+# gitconfig. We can identify the relevant ones by checking that they
+# point to somewhere in our $DEST directory.
+sudo sed -i "/directory=${DEST}/ d" /etc/gitconfig