diff --git a/boring-sys/build/main.rs b/boring-sys/build/main.rs
index a34270cc6..709e4949e 100644
--- a/boring-sys/build/main.rs
+++ b/boring-sys/build/main.rs
@@ -158,7 +158,7 @@ fn get_boringssl_source_path(config: &Config) -> &Path {
             println!("cargo:warning=fetching boringssl git submodule");
 
             run_command(
-                Command::new("git")
+                git_command()
                     .args(["submodule", "update", "--init", "--recursive"])
                     .arg(&submodule_path),
             )
@@ -497,7 +497,7 @@ fn ensure_patches_applied(config: &Config) -> io::Result<()> {
 
     // NOTE: init git in the copied files, so we can apply patches
     if !has_git {
-        run_command(Command::new("git").arg("init").current_dir(src_path))?;
+        run_command(git_command().arg("init").current_dir(src_path))?;
     }
 
     if config.features.allow_crl_extensions_bad_version {
@@ -549,7 +549,7 @@ fn apply_patch(config: &Config, patch_name: &str) -> io::Result<()> {
     }
 
     run_command(
-        Command::new("git")
+        git_command()
             .args(&args)
             .arg(cmd_path)
             .current_dir(src_path),
@@ -558,6 +558,36 @@ fn apply_patch(config: &Config, patch_name: &str) -> io::Result<()> {
     Ok(())
 }
 
+/// Repository-local variables, as listed by `git rev-parse --local-env-vars`.
+///
+/// Git sets these when it runs hooks, so a build started from a hook would
+/// otherwise run `git` against the caller's repository instead of the BoringSSL sources.
+const GIT_LOCAL_ENV_VARS: &[&str] = &[
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_CONFIG",
+    "GIT_CONFIG_PARAMETERS",
+    "GIT_CONFIG_COUNT",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_DIR",
+    "GIT_WORK_TREE",
+    "GIT_IMPLICIT_WORK_TREE",
+    "GIT_GRAFT_FILE",
+    "GIT_INDEX_FILE",
+    "GIT_NO_REPLACE_OBJECTS",
+    "GIT_REPLACE_REF_BASE",
+    "GIT_PREFIX",
+    "GIT_SHALLOW_FILE",
+    "GIT_COMMON_DIR",
+];
+
+fn git_command() -> Command {
+    let mut command = Command::new("git");
+    for var in GIT_LOCAL_ENV_VARS {
+        command.env_remove(var);
+    }
+    command
+}
+
 fn run_command(command: &mut Command) -> io::Result<Output> {
     let out = command.output().map_err(|e| {
         io::Error::new(