diff --git a/dagger/pipeline.go b/dagger/pipeline.go
index 27df448d..04b7d436 100644
--- a/dagger/pipeline.go
+++ b/dagger/pipeline.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"io/fs"
 	"net"
+	"net/url"
 	"path"
 	"strings"
 
@@ -762,6 +763,34 @@ func (p *Pipeline) FetchGit(ctx context.Context, op *compiler.Value, st llb.Stat
 		return st, err
 	}
 
+	remoteRedacted := remote
+	if u, err := url.Parse(remote); err == nil {
+		remoteRedacted = u.Redacted()
+	}
+
+	gitOpts := []llb.GitOption{}
+	var opts struct {
+		AuthTokenSecret  string
+		AuthHeaderSecret string
+		KeepGitDir       bool
+	}
+
+	if err := op.Decode(&opts); err != nil {
+		return st, err
+	}
+
+	if opts.KeepGitDir {
+		gitOpts = append(gitOpts, llb.KeepGitDir())
+	}
+	if opts.AuthTokenSecret != "" {
+		gitOpts = append(gitOpts, llb.AuthTokenSecret(opts.AuthTokenSecret))
+	}
+	if opts.AuthHeaderSecret != "" {
+		gitOpts = append(gitOpts, llb.AuthTokenSecret(opts.AuthHeaderSecret))
+	}
+
+	gitOpts = append(gitOpts, llb.WithCustomName(p.vertexNamef("FetchGit %s@%s", remoteRedacted, ref)))
+
 	// FIXME: Remove the `Copy` and use `Git` directly.
 	//
 	// Copy'ing is a costly operation which should be unnecessary.
@@ -771,12 +800,12 @@ func (p *Pipeline) FetchGit(ctx context.Context, op *compiler.Value, st llb.Stat
 			llb.Git(
 				remote,
 				ref,
-				llb.WithCustomName(p.vertexNamef("FetchGit %s@%s", remote, ref)),
+				gitOpts...,
 			),
 			"/",
 			"/",
 		),
-		llb.WithCustomName(p.vertexNamef("FetchGit %s@%s [copy]", remote, ref)),
+		llb.WithCustomName(p.vertexNamef("FetchGit %s@%s [copy]", remoteRedacted, ref)),
 	), nil
 }
 
diff --git a/stdlib/dagger/op/op.cue b/stdlib/dagger/op/op.cue
index 43484781..b590160e 100644
--- a/stdlib/dagger/op/op.cue
+++ b/stdlib/dagger/op/op.cue
@@ -77,9 +77,13 @@ package op
 }
 
 #FetchGit: {
-	do:     "fetch-git"
-	remote: string
-	ref:    string
+	do:          "fetch-git"
+	remote:      string
+	ref:         string
+	keepGitDir?: bool
+	// FIXME: the two options are currently ignored until we support buildkit secrets
+	authTokenSecret?:  string | bytes
+	authHeaderSecret?: string | bytes
 }
 
 #Copy: {
diff --git a/tests/ops.bats b/tests/ops.bats
index 43faf285..943acdef 100644
--- a/tests/ops.bats
+++ b/tests/ops.bats
@@ -105,6 +105,9 @@ setup() {
     run "$DAGGER" compute "$TESTDIR"/ops/fetch-git/nonexistent/bork
     assert_failure
 
+    run "$DAGGER" compute "$TESTDIR"/ops/fetch-git/gitdir
+    assert_success
+
     # FIXME: distinguish missing inputs from incorrect config
     # run "$DAGGER" compute "$TESTDIR"/ops/fetch-git/invalid
     # assert_failure
diff --git a/tests/ops/fetch-git/gitdir/main.cue b/tests/ops/fetch-git/gitdir/main.cue
new file mode 100644
index 00000000..61fc0607
--- /dev/null
+++ b/tests/ops/fetch-git/gitdir/main.cue
@@ -0,0 +1,35 @@
+package testing
+
+import "dagger.io/dagger/op"
+
+repo1: #up: [
+	op.#FetchGit & {
+		remote: "https://github.com/blocklayerhq/acme-clothing.git"
+		ref:    "master"
+	},
+]
+
+repo2: #up: [
+	op.#FetchGit & {
+		remote:     "https://github.com/blocklayerhq/acme-clothing.git"
+		ref:        "master"
+		keepGitDir: true
+	},
+]
+
+#up: [
+	op.#FetchContainer & {
+		ref: "alpine"
+	},
+	op.#Exec & {
+		args: ["sh", "-c", """
+			set -eu
+			[ ! -d /repo1/.git ]
+			[ -d /repo2/.git ]
+			"""]
+		mount: {
+			"/repo1": from: repo1
+			"/repo2": from: repo2
+		}
+	},
+]