@@ -361,6 +361,21 @@ def _module_abspath(
             )
         raise NotADirectoryError()
 
+    @classmethod
+    def _transport_env(cls, allow_unsafe_protocols: bool = False) -> Dict[str, str]:
+        """
+        :return:
+            Environment for clones and fetches whose URL comes from ``.gitmodules``.
+
+            :manpage:`git-submodule(1)` runs those with ``GIT_PROTOCOL_FROM_USER=0``, so
+            that git refuses every transport whose ``protocol.<name>.allow`` policy is
+            ``user``, which it is for ``file`` since git 2.38.1, unless the user
+            configured ``protocol.<name>.allow=always``.
+        """
+        if allow_unsafe_protocols:
+            return {}
+        return {"GIT_PROTOCOL_FROM_USER": "0"}
+
     @classmethod
     def _clone_repo(
         cls,
@@ -849,7 +864,10 @@ def update(
             They only take effect with the `init` option.
 
         :param allow_unsafe_protocols:
-            Allow unsafe protocols to be used, like ``ext``.
+            Allow unsafe protocols to be used, like ``ext``. This also runs the clone
+            and the fetches as if their URL came from the user, so that git accepts a
+            transport whose ``protocol.<name>.allow`` policy is ``user``, such as
+            ``file``, without ``protocol.<name>.allow=always`` being configured.
 
         :param allow_unsafe_options:
             Allow unsafe options to be used, like ``--upload-pack``.
@@ -900,7 +918,8 @@ def fetch_remotes(module_repo: "Repo") -> None:
                 )
                 # ===============================
                 if not dry_run:
-                    remote.fetch(progress=progress)
+                    with module_repo.git.custom_environment(**self._transport_env(allow_unsafe_protocols)):
+                        remote.fetch(progress=progress)
                 # END handle dry-run
                 # ===============================
                 if i == len_rmts - 1:
@@ -987,7 +1006,7 @@ def fetch_remotes(module_repo: "Repo") -> None:
                             self.path,
                             self.name,
                             n=True,
-                            env=env,
+                            env={**self._transport_env(allow_unsafe_protocols), **(env or {})},
                             multi_options=clone_multi_options,
                             allow_unsafe_options=allow_unsafe_options,
                             allow_unsafe_protocols=allow_unsafe_protocols,
 
@@ -305,7 +305,8 @@ def update(  # type: ignore[override]
                                 else:
                                     assert nn not in [r.name for r in rmts]
                                     smr = smm.create_remote(nn, sm_url)
-                                    smr.fetch(progress=progress)
+                                    with smm.git.custom_environment(**sm._transport_env()):
+                                        smr.fetch(progress=progress)
 
                                     # If we have a tracking branch, it should be available
                                     # in the new remote as well.
 
@@ -10,6 +10,7 @@
     "with_rw_directory",
     "with_rw_repo",
     "with_rw_and_rw_remote_repo",
+    "patch_git_config",
     "PathLikeMock",
     "TestBase",
     "VirtualEnvironment",
@@ -39,6 +40,7 @@
 import textwrap
 import time
 import unittest
+from unittest import mock
 import venv
 from typing import Union, Type, Tuple
 
@@ -84,6 +86,26 @@ def fixture(name):
 # { Adapters
 
 
+@contextlib.contextmanager
+def patch_git_config(name, value):
+    """Temporarily add a git config name-value pair, using environment variables."""
+    pair_index = int(os.getenv("GIT_CONFIG_COUNT", "0"))
+
+    # This is recomputed each time the context is entered, for compatibility with
+    # existing GIT_CONFIG_* environment variables, even if changed in this process.
+    patcher = mock.patch.dict(
+        os.environ,
+        {
+            "GIT_CONFIG_COUNT": str(pair_index + 1),
+            f"GIT_CONFIG_KEY_{pair_index}": name,
+            f"GIT_CONFIG_VALUE_{pair_index}": value,
+        },
+    )
+
+    with patcher:
+        yield
+
+
 class StringProcessAdapter:
     """Allows strings to be used as process objects returned by subprocess.Popen.
 
 
@@ -8,7 +8,7 @@
 import os.path
 
 from test.lib import TestBase
-from test.lib.helper import with_rw_directory, with_rw_repo
+from test.lib.helper import patch_git_config, with_rw_directory, with_rw_repo
 
 
 class Tutorials(TestBase):
@@ -479,6 +479,7 @@ def test_references_and_objects(self, rw_dir):
         repo.git.clear_cache()
 
     @with_rw_repo("c15a6e1923a14bc760851913858a3942a4193cdb")
+    @patch_git_config("protocol.file.allow", "always")
     def test_submodules(self, repo):
         # [1-test_submodules]
         sms = repo.submodules