diff --git a/.github/workflows/pkg-installer.yml b/.github/workflows/pkg-installer.yml
index d04ea663045d1..947906d08f100 100644
--- a/.github/workflows/pkg-installer.yml
+++ b/.github/workflows/pkg-installer.yml
@@ -126,14 +126,25 @@ jobs:
           path: Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg
   test:
     needs: build
+    name: "test (${{matrix.name}})"
     runs-on: ${{ matrix.runner }}
     strategy:
+      fail-fast: false
       matrix:
         include:
-          # Intel (free)
-          - runner: macos-latest
-          # Apple Silicon (paid)
-          - runner: macos-latest-xlarge
+          # Intel
+          - runner: macos-12
+            name: macos-12-x86_64
+          - runner: macos-13
+            name: macos-13-x86_64
+          # Apple Silicon
+          - runner: macos-13-xlarge
+            name: macos-13-arm64
+          # TODO: add when available
+          # - runner: macos-14
+          #   name: macos-14-x86_64
+          # - runner: macos-14-xlarge
+          #   name: macos-14-arm64
     steps:
       - name: Download installer from GitHub Actions
         uses: actions/download-artifact@v3
diff --git a/package/scripts/postinstall b/package/scripts/postinstall
index d3a5710a68b8b..c2a60232ac5e9 100755
--- a/package/scripts/postinstall
+++ b/package/scripts/postinstall
@@ -21,13 +21,35 @@ fi
 # add Git to path
 export PATH="/Library/Developer/CommandLineTools/usr/bin:/Applications/Xcode.app/Contents/Developer/usr/bin:${PATH}"
 
+# helpers for setting/unsetting Git's safe directory setting
+set_git_safe_directory() {
+  if git config --global --get-all safe.directory | grep -q "${1}"
+  then
+    return
+  fi
+  SET_GIT_SAFE_DIRECTORY="${1}"
+  git config --global --add safe.directory "${1}"
+}
+unset_git_safe_directory() {
+  if [[ -z "${SET_GIT_SAFE_DIRECTORY-}" ]]
+  then
+    return
+  fi
+
+  git config --global --unset safe.directory "${1}" || git config --global --unset-all safe.directory
+  if [[ ${SET_GIT_SAFE_DIRECTORY-} == "${1}" ]]
+  then
+    unset SET_GIT_SAFE_DIRECTORY
+  fi
+}
+
 # reset Git repository
 cd "${homebrew_directory}"
-git config --global --add safe.directory "${homebrew_directory}"
+set_git_safe_directory "${homebrew_directory}"
 git reset --hard
 git checkout --force master
 git branch | grep -v '\*' | xargs -n 1 git branch --delete --force || true
-git config --global --unset safe.directory "${homebrew_directory}"
+unset_git_safe_directory "${homebrew_directory}"
 
 # move to /usr/local if on x86_64
 if [[ $(uname -m) == "x86_64" ]]
@@ -36,8 +58,11 @@ then
   then
     cp -pRL "${homebrew_directory}/.git" "/usr/local/Homebrew/"
     mv "${homebrew_directory}/cache_api" "/usr/local/Homebrew/"
+
+    set_git_safe_directory /usr/local/Homebrew
     git -C /usr/local/Homebrew reset --hard
     git -C /usr/local/Homebrew checkout --force master
+    unset_git_safe_directory /usr/local/Homebrew
   else
     mkdir -vp /usr/local/bin
     mv "${homebrew_directory}" "/usr/local/Homebrew/"