diff --git a/.github/workflows/update-submodules.yml b/.github/workflows/update-submodules.yml
index 241548b67..93b0437fb 100644
--- a/.github/workflows/update-submodules.yml
+++ b/.github/workflows/update-submodules.yml
@@ -25,5 +25,5 @@ jobs:
         git config user.name "DFHack-Urist via GitHub Actions"
         git config user.email "DFHack-Urist@users.noreply.github.com"
         if bash -x ci/update-submodules.bash; then
-          git push
+          git push --recurse-submodules=check
         fi
diff --git a/ci/update-submodules.bash b/ci/update-submodules.bash
index 95727e42a..312d8f1d3 100755
--- a/ci/update-submodules.bash
+++ b/ci/update-submodules.bash
@@ -22,7 +22,7 @@ cat ci/update-submodules.manifest | while read path branch; do
     cd "${git_root}/${path}"
     test "${git_root}" != "$(get_git_root)"
     git checkout "${branch}"
-    git pull
+    git pull --ff-only
     cd "${git_root}"
     if ! git diff --quiet --ignore-submodules=dirty -- "${path}"; then
         git add "${path}"