diff --git a/functions/concrete/run/stages/get_sources.go b/functions/concrete/run/stages/get_sources.go
index 28c49fe0..2223366a 100644
--- a/functions/concrete/run/stages/get_sources.go
+++ b/functions/concrete/run/stages/get_sources.go
@@ -539,7 +539,8 @@ func (s GetSources) gitCheckout(ctx context.Context, e *env.Env, extraEnv map[st
 	}
 	e.Noticef("Checking out %s as detached HEAD (ref is %s)...", short, s.Ref)
 
-	if err := git(ctx, e, extraEnv, "-c", "submodule.recurse=false", "checkout", "-f", "-q", s.SHA); err != nil {
+	checkoutArgs := append(s.configArgs(), "-c", "submodule.recurse=false", "checkout", "-f", "-q", s.SHA)
+	if err := git(ctx, e, extraEnv, checkoutArgs...); err != nil {
 		return fmt.Errorf("git checkout: %w", err)
 	}
 
diff --git a/shells/abstract.go b/shells/abstract.go
index fad21488..cd430752 100644
--- a/shells/abstract.go
+++ b/shells/abstract.go
@@ -1074,7 +1074,16 @@ func (b *AbstractShell) writeGitCleanupAllConfigs(sw ShellWriter, build *common.
 
 func (b *AbstractShell) writeCheckoutCmd(w ShellWriter, build *common.Build) {
 	w.Noticef("Checking out %s as detached HEAD (ref is %s)...", build.GitInfo.Sha[0:8], build.GitInfo.Ref)
-	w.Command("git", "-c", "submodule.recurse=false", "checkout", "-f", "-q", build.GitInfo.Sha)
+
+	checkoutArgs := []string{"-c", "submodule.recurse=false"}
+	// Force Git to send credentials proactively instead of waiting for a 401.
+	// This is needed because git checkout in partial-clone repositories can
+	// trigger lazy fetches from the promisor remote to retrieve missing objects.
+	if build.IsFeatureFlagOn(featureflags.UseGitProactiveAuth) {
+		checkoutArgs = append(checkoutArgs, "-c", "http.proactiveAuth=basic")
+	}
+	checkoutArgs = append(checkoutArgs, "checkout", "-f", "-q", build.GitInfo.Sha)
+	w.Command("git", checkoutArgs...)
 
 	cleanFlags := build.GetGitCleanFlags()
 	if len(cleanFlags) > 0 {