diff --git a/scripts/Invoke-RemoteBuild.ps1 b/scripts/Invoke-RemoteBuild.ps1
index 78af43c..48b54bb 100644
--- a/scripts/Invoke-RemoteBuild.ps1
+++ b/scripts/Invoke-RemoteBuild.ps1
@@ -245,6 +245,13 @@ try {
             if ($submodules) { $gitArgs += '--recurse-submodules' }
             $gitArgs += @($cloneUrl, (Split-Path $workDir -Leaf))
 
+            # Disable interactive credential prompts — WinRM has no TTY
+            $env:GIT_TERMINAL_PROMPT = '0'
+
+            # Clear any system credential helper (e.g. GCM) that may try to open UI/TTY.
+            # '-c credential.helper=' (empty) resets the helper chain before we inject ours.
+            $credHelperArgs = @('-c', 'credential.helper=')
+
             # Credentials via temp .git-credentials file (§1.5: token never in URL, argv, or logs)
             $tmpCreds = $null
             if ($patUser -and $patPass) {
@@ -252,9 +259,11 @@ try {
                 $credLine = "$($uri.Scheme)://${patUser}:${patPass}@$($uri.Host)"
                 $tmpCreds = "C:\CI\tmp_gc_$([guid]::NewGuid().ToString('N'))"
                 [System.IO.File]::WriteAllText($tmpCreds, $credLine)
-                $gitArgs = @('-c', "credential.helper=store --file $tmpCreds") + $gitArgs
+                $credHelperArgs += @('-c', "credential.helper=store --file $tmpCreds")
             }
 
+            $gitArgs = $credHelperArgs + $gitArgs
+
             try {
                 Write-Host "[Guest] Cloning $cloneUrl (branch: $branch)..."
                 & git @gitArgs 2>&1 | ForEach-Object { Write-Host "[Guest Clone] $_" }