diff --git a/git/git.yaml b/git/git.yaml
index 2e66b9d..a0ad441 100644
--- a/git/git.yaml
+++ b/git/git.yaml
@@ -236,7 +236,7 @@
             - name: github-secrets
               secret:
                 secretName: github-secrets
-                defaultMode: 0400
+                defaultMode: 0444
             - name: data
               persistentVolumeClaim:
                 claimName: git-data
@@ -244,6 +244,9 @@
           containers:
             - name: master
               image: buildpack-deps:scm
+              securityContext:
+                runAsUser: 100
+                runAsGroup: 101
               command:
                 - bash
                 - -c
@@ -259,22 +262,30 @@
                       fibers \
                       hellonet \
                       instadump \
+                      jgvariant \
                       json-template-r6rs \
                       json-template-racket \
                       json-template-typed-racket \
                       logikorr \
                       mulkcms \
+                      mulkcms2 \
                       mulkjournal \
                       mulklib \
+                      mulkontainers \
                       mulkrypt-for-racket \
                       mulkyid \
                       objective-cl \
+                      quarkus-googlecloud-jsonlogging \
                       toilet
                   do
                       cd "/git/repositories/mulk/$x.git"
+                      git fetch "https://gitlab.benkard.de/mulk/${x}.git" master:master
                       git push "git@github.com:benkard/${x}.git" master
                   done
                   true
+              env:
+                - name: HOME
+                  value: /nonexistent
               resources:
                 limits:
                   memory: 100Mi
@@ -283,7 +294,7 @@
                   memory: 100Mi
               volumeMounts:
                 - name: github-secrets
-                  mountPath: /root/.ssh
+                  mountPath: /nonexistent/.ssh
                   readOnly: true
                 - name: data
                   mountPath: /git