diff --git a/.github/scripts/aiter_prebuild_upload.sh b/.github/scripts/aiter_prebuild_upload.sh
index ca5d14cb9..a6598d57f 100755
--- a/.github/scripts/aiter_prebuild_upload.sh
+++ b/.github/scripts/aiter_prebuild_upload.sh
@@ -18,7 +18,7 @@ ROCM_VER="$(head -n1 "${ROCM_PATH}/.info/version" | sed -n 's/^\([0-9]\+\.[0-9]\
 AITER_DIR="${ROOT_DIR}/3rdparty/aiter"
 GIT_CONFIG_GLOBAL="$(mktemp /tmp/gitconfig.XXXXXX)"
 trap 'rm -f "${GIT_CONFIG_GLOBAL}"' EXIT
-git config --global --add safe.directory "${AITER_DIR}" --file "${GIT_CONFIG_GLOBAL}" >/dev/null 2>&1 || true
+git config --file "${GIT_CONFIG_GLOBAL}" --add safe.directory "${AITER_DIR}"
 AITER_SHA="$(GIT_CONFIG_GLOBAL=${GIT_CONFIG_GLOBAL} git -C "${AITER_DIR}" rev-parse HEAD)"
 
 KEY="rocm-${ROCM_VER}_aiter-${AITER_SHA}"
diff --git a/.github/workflows/aiter-prebuilt-upload.yml b/.github/workflows/aiter-prebuilt-upload.yml
index acd9c58b4..8d9bdeaae 100644
--- a/.github/workflows/aiter-prebuilt-upload.yml
+++ b/.github/workflows/aiter-prebuilt-upload.yml
@@ -61,11 +61,18 @@ jobs:
           docker exec \
             -e NVTE_AITER_PREBUILT_BASE_URL=${NVTE_AITER_PREBUILT_BASE_URL} \
             -e NVTE_AITER_PREBUILT_UPLOAD_TOKEN=${NVTE_AITER_PREBUILT_UPLOAD_TOKEN} \
-            te-aiter-upload bash -c 'set -ex
-              if [ -z "${NVTE_AITER_PREBUILT_UPLOAD_TOKEN}" ]; then
-                echo "Missing secrets.AITER_ARTIFACTORY_TOKEN" >&2
-                exit 1
-              fi
-              export HIP_PATH=""
-              bash .github/scripts/aiter_prebuild_upload.sh --build
-            '
+            te-aiter-upload bash -c "$(cat <<'EOF'
+          set -ex
+          if [ -z "${NVTE_AITER_PREBUILT_UPLOAD_TOKEN}" ]; then
+            echo "Missing secrets.AITER_ARTIFACTORY_TOKEN" >&2
+            exit 1
+          fi
+          export HIP_PATH=""
+          git config --global --add safe.directory '*'
+          bash .github/scripts/aiter_prebuild_upload.sh --build
+          EOF
+          )"
+
+      - name: Cleanup container
+        if: always()
+        run: docker rm -f te-aiter-upload || true