diff --git a/tool/ports/mk/common.inc b/tool/ports/mk/common.inc
index f2bbcc1e8..1c80f09e5 100644
--- a/tool/ports/mk/common.inc
+++ b/tool/ports/mk/common.inc
@@ -8,6 +8,9 @@ SHELL   := bash
 VERBOSE ?= @
 ECHO    := echo -e
 
+# limit destructive git operations (e.g., reset) to local directory
+GIT := git --git-dir=.git
+
 BRIGHT_COL  ?= \x1b[01;33m
 DARK_COL    ?= \x1b[00;33m
 DEFAULT_COL ?= \x1b[0m
diff --git a/tool/ports/mk/install.mk b/tool/ports/mk/install.mk
index bb1aeadcc..efb40cc3b 100644
--- a/tool/ports/mk/install.mk
+++ b/tool/ports/mk/install.mk
@@ -162,7 +162,7 @@ _git_dir = $(call _assert,$(DIR($1)),Missing declaration of DIR($*))
 		test -d $$dir || $(MSG_DOWNLOAD)$(URL($*)); \
 		test -d $$dir || git clone $(URL($*)) $$dir &> >(sed 's/^/$(MSG_GIT)/'); \
 		$(MSG_UPDATE)$$dir; \
-		cd $$dir && git fetch && git reset -q --hard HEAD && git checkout -q $(REV($*))
+		cd $$dir && $(GIT) fetch && $(GIT) reset -q --hard HEAD && $(GIT) checkout -q $(REV($*))
 
 
 ##