diff --git a/infra/packer/provision.sh b/infra/packer/provision.sh
index 59e21c5e..2109d2d5 100755
--- a/infra/packer/provision.sh
+++ b/infra/packer/provision.sh
@@ -69,7 +69,9 @@ echo "=== [3/7] clone-or-update repo @ \$HOME/$REPO_PATH (ref $GIT_REF) ==="
 # Idempotent: clone on a cold build, fetch+reset on an incremental rebuild (the
 # repo is already present when building FROM a previous golden snapshot).
 as_user "mkdir -p ~/$(dirname "$REPO_PATH")"
-as_user "if [ -d ~/$REPO_PATH/.git ]; then cd ~/$REPO_PATH && git remote set-url origin '$GIT_REMOTE' && git fetch --depth=1 origin '$GIT_REF' && git reset --hard FETCH_HEAD; else git clone '$GIT_REMOTE' ~/$REPO_PATH && cd ~/$REPO_PATH && git checkout -f '$GIT_REF'; fi"
+# Always shallow (--depth 1): the forge holds full history (8.4G of old committed
+# target/ blobs), but we only need the current tree (~209MB). Uniform clone-or-fetch.
+as_user "if [ ! -d ~/$REPO_PATH/.git ]; then git clone --depth 1 '$GIT_REMOTE' ~/$REPO_PATH; fi; cd ~/$REPO_PATH && git remote set-url origin '$GIT_REMOTE' && git fetch --depth=1 origin '$GIT_REF' && git reset --hard FETCH_HEAD"
 
 echo "=== [4/7] toolchain via scripts/dev-setup/linux.sh ==="
 # WITH_RUNNER must be defined: linux.sh references it unguarded under set -u and