diff --git a/salt/dotfiles b/salt/dotfiles
index f945709..7659897 160000
--- a/salt/dotfiles
+++ b/salt/dotfiles
@@ -1 +1 @@
-Subproject commit f9457092eaeddd4a21419620291a0cf1ab1bd277
+Subproject commit 7659897283297be0ee9e5e41943c05a8a925e688
diff --git a/salt/sys-git/install-client.sls b/salt/sys-git/install-client.sls
index bf6521b..e6d7643 100644
--- a/salt/sys-git/install-client.sls
+++ b/salt/sys-git/install-client.sls
@@ -50,7 +50,13 @@ include:
       - user
       - group
 
+{% if not salt['file.file_exists']('/usr/share/whonix/marker') -%}
+{# Whonix's security-misc package owns /etc/gitconfig, fallback to Git dotfiles
+   to set this option. #}
+
 "{{ slsdotpath }}-install-client-allow-protocol":
   cmd.run:
     - name: git config --system protocol.qrexec.allow always
     - runas: root
+
+{% endif -%}