diff --git a/codex-rs/git-utils/src/guarded_config.rs b/codex-rs/git-utils/src/guarded_config.rs
index 1909972a8d..35fd1d67b6 100644
--- a/codex-rs/git-utils/src/guarded_config.rs
+++ b/codex-rs/git-utils/src/guarded_config.rs
@@ -846,15 +846,16 @@ impl<'git> GuardedGitConfig<'git> {
         value: &str,
     ) -> io::Result<()> {
         debug_assert!(matches!(name, "clean" | "smudge" | "process" | "required"));
-        let mut command = self
-            .sources
-            .git
-            .command_for_cwd(&self.sources.canonical_root)?;
-        command
-            .args(&self.sources.base_config_args)
-            .args(["config", "--file"])
-            .arg(config_path)
-            .args(["--add", &format!("filter.{driver}.{name}"), value]);
+        // The destination is operation-owned and absolute. Avoid repository
+        // setup while serializing the already inventoried driver names: a
+        // malformed repository setting must not preempt the typed policy
+        // error that the guarded operation reports later.
+        let mut command = self.sources.git.command();
+        command.args(["config", "--file"]).arg(config_path).args([
+            "--add",
+            &format!("filter.{driver}.{name}"),
+            value,
+        ]);
         let output = self.sources.git.output(command)?;
         if !output.status.success() {
             return Err(io::Error::other(format!(
diff --git a/codex-rs/git-utils/src/merge_driver_tests.rs b/codex-rs/git-utils/src/merge_driver_tests.rs
index 1bdb4a812b..32b84cd69b 100644
--- a/codex-rs/git-utils/src/merge_driver_tests.rs
+++ b/codex-rs/git-utils/src/merge_driver_tests.rs
@@ -1242,6 +1242,12 @@ fn malformed_shared_repository_refuses_before_reverse_index_staging() {
     let diff = build_three_way_fixture(root);
     let index_path = root.join(".git/index");
     let before_index = std::fs::read(&index_path).expect("read index before refusal");
+    let unused_filter = run(root, &["git", "config", "filter.lfs.clean", "cat"]);
+    assert_eq!(
+        unused_filter.0, 0,
+        "configure unused filter: {}",
+        unused_filter.2
+    );
     let configured = run(
         root,
         &["git", "config", "core.sharedRepository", "not-a-permission"],