diff --git a/git/git-credential.sh b/git/git-credential.sh
index f1b9d2b..8051c6c 100755
--- a/git/git-credential.sh
+++ b/git/git-credential.sh
@@ -21,23 +21,40 @@ warn_store_fallback() {
 EOF
 }
 
+# helper 在 `git --exec-path`，不一定在 PATH。必须 exec 绝对路径：
+# Apple Git 的 osxkeychain 会对 argv[0] 做 O_EXLOCK，相对名会去锁 cwd 下的同名文件。
+dotfile_git_credential_exec() {
+    local name="$1"
+    shift
+    local helper=""
+    local exec_path
+    exec_path="$(git --exec-path 2>/dev/null || true)"
+    if [ -n "$exec_path" ] && [ -x "$exec_path/git-credential-$name" ]; then
+        helper="$exec_path/git-credential-$name"
+    elif command -v "git-credential-$name" >/dev/null 2>&1; then
+        helper="$(command -v "git-credential-$name")"
+    else
+        return 1
+    fi
+    exec "$helper" "$@"
+}
+
 case "$(uname -s)" in
 Darwin)
-    if command -v git-credential-osxkeychain >/dev/null 2>&1; then
-        exec git-credential-osxkeychain "$@"
-    fi
+    dotfile_git_credential_exec osxkeychain "$@" || true
     warn_store_fallback "未找到 osxkeychain"
-    exec git-credential-store "$@"
+    dotfile_git_credential_exec store "$@" || true
     ;;
 Linux)
-    if command -v git-credential-libsecret >/dev/null 2>&1; then
-        exec git-credential-libsecret "$@"
-    fi
+    dotfile_git_credential_exec libsecret "$@" || true
     warn_store_fallback "未找到 git-credential-libsecret"
-    exec git-credential-store "$@"
+    dotfile_git_credential_exec store "$@" || true
     ;;
 *)
     warn_store_fallback "未知系统 $(uname -s)"
-    exec git-credential-store "$@"
+    dotfile_git_credential_exec store "$@" || true
     ;;
 esac
+
+echo "git credential helper 不可用" >&2
+exit 1