diff --git a/internal/cmd/agent/register/register.go b/internal/cmd/agent/register/register.go
index 666c15465c..4ee0c313a6 100644
--- a/internal/cmd/agent/register/register.go
+++ b/internal/cmd/agent/register/register.go
@@ -326,6 +326,7 @@ func createClientConfigFromSecret(secret *corev1.Secret, trustSystemStoreCAs boo
 	token := string(data[Token])
 
 	if trustSystemStoreCAs { // Save a request to the API server URL if system CAs are not to be trusted.
+		// NOTE(manno): client-go will use the system trust store even if a CA is configured. So, why do this?
 		if _, err := http.Get(apiServerURL); err == nil {
 			apiServerCA = nil
 		}
diff --git a/internal/cmd/cli/gitcloner/cloner.go b/internal/cmd/cli/gitcloner/cloner.go
index 511c5e321c..d0e63f17c9 100644
--- a/internal/cmd/cli/gitcloner/cloner.go
+++ b/internal/cmd/cli/gitcloner/cloner.go
@@ -73,12 +73,13 @@ func (c *Cloner) CloneRepo(opts *GitCloner) error {
 
 func cloneBranch(opts *GitCloner, auth transport.AuthMethod, caBundle []byte) error {
 	_, err := plainClone(opts.Path, false, &git.CloneOptions{
-		URL:             opts.Repo,
-		Auth:            auth,
-		InsecureSkipTLS: opts.InsecureSkipTLS,
-		CABundle:        caBundle,
-		SingleBranch:    true,
-		ReferenceName:   plumbing.ReferenceName(opts.Branch),
+		URL:               opts.Repo,
+		Auth:              auth,
+		InsecureSkipTLS:   opts.InsecureSkipTLS,
+		CABundle:          caBundle,
+		SingleBranch:      true,
+		ReferenceName:     plumbing.ReferenceName(opts.Branch),
+		RecurseSubmodules: git.DefaultSubmoduleRecursionDepth,
 	})
 
 	return err
@@ -86,10 +87,11 @@ func cloneBranch(opts *GitCloner, auth transport.AuthMethod, caBundle []byte) er
 
 func cloneRevision(opts *GitCloner, auth transport.AuthMethod, caBundle []byte) error {
 	r, err := plainClone(opts.Path, false, &git.CloneOptions{
-		URL:             opts.Repo,
-		Auth:            auth,
-		InsecureSkipTLS: opts.InsecureSkipTLS,
-		CABundle:        caBundle,
+		URL:               opts.Repo,
+		Auth:              auth,
+		InsecureSkipTLS:   opts.InsecureSkipTLS,
+		CABundle:          caBundle,
+		RecurseSubmodules: git.DefaultSubmoduleRecursionDepth,
 	})
 	if err != nil {
 		return err
diff --git a/internal/cmd/cli/gitcloner/cloner_test.go b/internal/cmd/cli/gitcloner/cloner_test.go
index 8ca0e1ae52..a50505fadc 100644
--- a/internal/cmd/cli/gitcloner/cloner_test.go
+++ b/internal/cmd/cli/gitcloner/cloner_test.go
@@ -83,9 +83,10 @@ udiSlDctMM/X3ZM2JN5M1rtAJ2WR3ZQtmWbOjZAbG2Eq
 				Branch: "master",
 			},
 			expectedCloneOpts: &git.CloneOptions{
-				URL:           "repo",
-				SingleBranch:  true,
-				ReferenceName: "master",
+				URL:               "repo",
+				SingleBranch:      true,
+				ReferenceName:     "master",
+				RecurseSubmodules: git.DefaultSubmoduleRecursionDepth,
 			},
 		},
 		"branch basic auth": {
@@ -104,6 +105,7 @@ udiSlDctMM/X3ZM2JN5M1rtAJ2WR3ZQtmWbOjZAbG2Eq
 					Username: "user",
 					Password: passwordFileContent,
 				},
+				RecurseSubmodules: git.DefaultSubmoduleRecursionDepth,
 			},
 		},
 		"branch ssh auth": {
@@ -114,10 +116,11 @@ udiSlDctMM/X3ZM2JN5M1rtAJ2WR3ZQtmWbOjZAbG2Eq
 				SSHPrivateKeyFile: sshPrivateKeyFile,
 			},
 			expectedCloneOpts: &git.CloneOptions{
-				URL:           "ssh://git@localhost/test/test-repo",
-				SingleBranch:  true,
-				ReferenceName: "master",
-				Auth:          sshAuth,
+				URL:               "ssh://git@localhost/test/test-repo",
+				SingleBranch:      true,
+				ReferenceName:     "master",
+				Auth:              sshAuth,
+				RecurseSubmodules: git.DefaultSubmoduleRecursionDepth,
 			},
 		},
 		"password file does not exist": {