diff --git a/roles/git_auto_update/templates/update.sh b/roles/git_auto_update/templates/update.sh
index 3facd48..07f1340 100644
--- a/roles/git_auto_update/templates/update.sh
+++ b/roles/git_auto_update/templates/update.sh
@@ -12,17 +12,17 @@ set -euo pipefail;
 cd "$DEST";
 
 if [ ! -d .git ]; then
-  git clone "$REPO" "$DEST";
+  git clone --recurse-submodules "$REPO" "$DEST";
 fi
 
 [ -z "$GPG_FINGERPRINT" ] ||
   gpg --quiet --keyserver eu.pool.sks-keyservers.net --recv "$GPG_FINGERPRINT";
 
-git fetch --tags > /dev/null;
+git fetch --recurse-submodules --tags > /dev/null;
 TAG=$(git tag --list | grep "^$PREFIX" | sort -r | head -n 1);
 if [ -z "$GPG_FINGERPRINT" ] || (git verify-tag --raw "$TAG" 2>&1 | grep --fixed-strings " VALIDSIG $GPG_FINGERPRINT ") > /dev/null; then
-  git reset --hard;
-  git checkout --quiet "$TAG";
+  git reset --hard --recurse-submodules;
+  git checkout --quiet --recurse-submodules "$TAG";
   chown --recursive "$DEST_USER:$DEST_GROUP" .;
   if ! sh -c {{ reload_command | default('true') | quote }}; then
     echo "Failed during reload" >&2;