diff --git a/internal/controller/gitlabjobrunner_controller.go b/internal/controller/gitlabjobrunner_controller.go
index 68326b6..b99841d 100644
--- a/internal/controller/gitlabjobrunner_controller.go
+++ b/internal/controller/gitlabjobrunner_controller.go
@@ -310,13 +310,20 @@ func (r *GitlabJobRunnerReconciler) constructPodSpec(runner *batchv1alpha1.Gitla
 					"sh",
 					"-c",
 					fmt.Sprintf(`
+						set -e
 						REPO_URL="%s"
+
+						# Configure git credential helper
+						git config --global credential.helper store
+						echo "https://$GITLAB_TOKEN:x-oauth-basic@$(echo $GITLAB_URL | sed 's|https://||' | sed 's|/||')" > ~/.git-credentials
+
 						if echo "$REPO_URL" | grep -q '^https://'; then
-							# Full URL provided - use it directly with token injection
-							git clone -b %s --depth 1 $(echo $REPO_URL | sed "s|https://|https://oauth2:$GITLAB_TOKEN@|") /workspace
+							# Full URL provided
+							git clone -b %s --depth 1 "$REPO_URL" /workspace
 						else
 							# Relative path - construct URL from GITLAB_URL
-							git clone -b %s --depth 1 https://oauth2:$GITLAB_TOKEN@$(echo $GITLAB_URL | sed 's|https://||')/$REPO_URL /workspace
+							CLEAN_URL=$(echo $GITLAB_URL | sed 's|/$||')
+							git clone -b %s --depth 1 "$CLEAN_URL/$REPO_URL" /workspace
 						fi
 					`, runner.Spec.RepositoryURL, branch, branch),
 				},