diff --git a/scripts/setup.sh b/scripts/setup.sh
index a67a22f..ebb6803 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -52,7 +52,12 @@ fetch_pinned() {
    rm -f "/tmp/${name}-${sha}.tar.gz"
    git -C "$dest" init -q
    git -C "$dest" add -A
-   git -C "$dest" commit -q -m "vendor: $name @ $sha" --author="vpinball-wasm setup <noreply@localhost>"
+   # -c user.name/user.email (not --author) are needed here: --author only sets
+   # the commit's author field, but git also requires a *committer* identity,
+   # which a fresh CI container has no ~/.gitconfig to supply. Scoped to this
+   # one invocation only - doesn't touch any persistent git config.
+   git -C "$dest" -c user.name="vpinball-wasm setup" -c user.email="noreply@localhost" \
+      commit -q -m "vendor: $name @ $sha" --author="vpinball-wasm setup <noreply@localhost>"
    echo "$sha" > "$sentinel"
 }