diff --git a/Dockerfile b/Dockerfile
index fa0e9c5..2d8e9fc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -93,9 +93,9 @@ ARG VARIANT=light
 
 RUN apk --no-cache add build-base git openssh && cd /tmp \
  && wget -q -O - https://github.com/thestinger.keys | while read -r key; do echo "thestinger@github.com $key"; done > allowed_signers \
- && git config --global gpg.ssh.allowedSignersFile /tmp/allowed_signers \
- && git clone --depth 1 https://github.com/GrapheneOS/hardened_malloc && cd hardened_malloc \
- && git checkout refs/tags/${HARDENED_MALLOC_VERSION} && git verify-tag $(git describe --tags) \
+ && git config --global gpg.ssh.allowedSignersFile /tmp/allowed_signers && git init hardened_malloc && cd hardened_malloc \
+ && git fetch --depth 1 https://github.com/GrapheneOS/hardened_malloc tag ${HARDENED_MALLOC_VERSION} \
+ && git checkout FETCH_HEAD && git verify-tag $(git describe --tags) \
  && make CONFIG_NATIVE=${CONFIG_NATIVE} VARIANT=${VARIANT}