diff --git a/terraform/build_packages_external.sh b/terraform/build_packages_external.sh
index a8e0dc4..38ea006 100755
--- a/terraform/build_packages_external.sh
+++ b/terraform/build_packages_external.sh
@@ -3,7 +3,10 @@
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")" && pwd)"
-"${ROOT}/build_packages.sh" >&2
+# artifacts.tf already launches this file with bash, so +x is not required
+# here. Invoke the inner script the same way so HCP plan does not depend on
+# the git executable bit.
+bash "${ROOT}/build_packages.sh" >&2
 
 if command -v sha256sum >/dev/null 2>&1; then
   SHA=(sha256sum)