diff --git a/src/BUILD.gn b/src/BUILD.gn
index 40aa2b1..7c0be40 100644
--- a/src/BUILD.gn
+++ b/src/BUILD.gn
@@ -137,5 +137,10 @@
     rebase_path("$target_gen_dir/$output_name"),
   ]
 
+  # Ensure that this action reruns when git HEAD moves
+  inputs += [ ".git/HEAD" ]
+  # The above makes it safe to ignore other .git/* accesses.
+  hermetic_action_ignored_prefixes = [ ".git/" ]
+
   public_configs = [ ":sha1_config" ]
 }