diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index fe2539f5a..8cd7ee861 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -181,6 +181,25 @@ jobs:
         with:
           args: bash __test__/verify-worktree.sh worktree-test container-worktree-branch
 
+      # Credentials when checkout out into symlink
+      - name: Setup for symlink test
+        run: mkdir symlink-test-real && ln -s symlink-test-real symlink-test-link
+      - name: Checkout for worktree test
+        uses: ./
+        with:
+          path: symlink-test-link
+      - name: Verify symlink credentials
+        run: |
+          cd symlink-test-real
+          if git config --list --show-origin | grep -q "extraheader"; then
+            echo "Credentials are configured"
+          else
+            echo "ERROR: Credentials are NOT configured"
+            echo "Full git config:"
+            git config --list --show-origin
+            exit 1
+          fi
+
       # Basic checkout using REST API
       - name: Remove basic
         if: runner.os != 'windows'
diff --git a/dist/index.js b/dist/index.js
index b9b34d342..8a3747866 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -267,7 +267,7 @@ class GitAuthHelper {
                 // Configure both host and container paths to support Docker container actions.
                 for (const configPath of configPaths) {
                     // Submodule Git directory
-                    let submoduleGitDir = path.dirname(configPath); // The config file is at .git/modules/submodule-name/config
+                    let submoduleGitDir = yield fs.promises.realpath(path.dirname(configPath)); // The config file is at .git/modules/submodule-name/config
                     submoduleGitDir = submoduleGitDir.replace(/\\/g, '/'); // Use forward slashes, even on Windows
                     // Configure host includeIf
                     yield this.git.config(`includeIf.gitdir:${submoduleGitDir}.path`, credentialsConfigPath, false, // globalConfig?
@@ -407,7 +407,7 @@ class GitAuthHelper {
             }
             else {
                 // Host git directory
-                let gitDir = path.join(this.git.getWorkingDirectory(), '.git');
+                let gitDir = yield fs.promises.realpath(path.join(this.git.getWorkingDirectory(), '.git'));
                 gitDir = gitDir.replace(/\\/g, '/'); // Use forward slashes, even on Windows
                 // Configure host includeIf
                 const hostIncludeKey = `includeIf.gitdir:${gitDir}.path`;
diff --git a/src/git-auth-helper.ts b/src/git-auth-helper.ts
index e67db148a..ddd886239 100644
--- a/src/git-auth-helper.ts
+++ b/src/git-auth-helper.ts
@@ -177,7 +177,9 @@ class GitAuthHelper {
       // Configure both host and container paths to support Docker container actions.
       for (const configPath of configPaths) {
         // Submodule Git directory
-        let submoduleGitDir = path.dirname(configPath) // The config file is at .git/modules/submodule-name/config
+        let submoduleGitDir = await fs.promises.realpath(
+          path.dirname(configPath)
+        ) // The config file is at .git/modules/submodule-name/config
         submoduleGitDir = submoduleGitDir.replace(/\\/g, '/') // Use forward slashes, even on Windows
 
         // Configure host includeIf
@@ -367,7 +369,9 @@ class GitAuthHelper {
       )
     } else {
       // Host git directory
-      let gitDir = path.join(this.git.getWorkingDirectory(), '.git')
+      let gitDir = await fs.promises.realpath(
+        path.join(this.git.getWorkingDirectory(), '.git')
+      )
       gitDir = gitDir.replace(/\\/g, '/') // Use forward slashes, even on Windows
 
       // Configure host includeIf