diff --git a/roles/git/tasks/Windows-installer.yaml b/roles/git/tasks/Windows-installer.yaml
new file mode 100644
index 0000000..3e7a937
--- /dev/null
+++ b/roles/git/tasks/Windows-installer.yaml
@@ -0,0 +1,34 @@
+---
+- name: get json containing all releases
+  win_uri:
+    url: 'https://api.github.com/repos/git-for-windows/git/releases/tags/v{{git_version}}.windows.1'
+    return_content: true
+  register: git_release
+
+- set_fact:
+    git_installer_exe: 'Git-{{git_version}}-64-bit.exe'
+- set_fact:
+    git_asset_query: '[?contains(name, `{{git_installer_exe}}`)] | [0]'
+    git_installer_path: '{{ansible_env.TEMP}}/{{git_installer_exe}}'
+- name: select asset from release
+  set_fact:
+    git_asset: '{{git_release.json.assets | json_query(git_asset_query)}}'
+
+- name: download installer
+  win_get_url:
+    url: '{{git_asset.browser_download_url}}'
+    dest: '{{git_installer_path}}'
+
+- name: run installer command
+  win_command:
+    argv:
+      - '{{git_installer_path}}'
+      - '/GitAndUnixToolsOnPath'
+      - '/NoShellIntegration'
+      - '/NoGuiHereIntegration'
+      - '/NoCredentialManager'
+      - '/NoOpenSSH'
+      - '/Silent'
+      - '/SuppressMsgBoxes'
+      - '/NoCancel'
+      - '/NoRestart'
diff --git a/roles/git/tasks/Windows.yaml b/roles/git/tasks/Windows.yaml
index 6da37fd..d8f2626 100644
--- a/roles/git/tasks/Windows.yaml
+++ b/roles/git/tasks/Windows.yaml
@@ -1,14 +1,35 @@
 ---
-- name: install chocolatey package
-  win_chocolatey:
-    name: git
-    package_params: >-
-      /GitAndUnixToolsOnPath
-      /NoShellIntegration
-      /NoGuiHereIntegration
-      /NoCredentialManager
-      /NoOpenSSH
-    state: latest
+# Pinned to 2.36.1 because the unofficial win_git module hangs when using
+# 2.37.3, this is either a breaking change in 2.37.x or an incompatibility with
+# the win_git module. The git chocolatey package does not respect the version
+# argument and always installs the most recent version, so instead download the
+# installer from GitHub and install manually.
+- set_fact:
+    git_version: 2.36.1
+    git_cli_exe: '{{ansible_env.ProgramFiles}}/Git/cmd/git.exe'
+    git_run_installer: false
+
+- name: detect if Git for Windows is installed
+  win_stat:
+    path: '{{git_cli_exe}}'
+  register: git_cli_stat
+
+- when: not git_cli_stat.stat.exists
+  set_fact:
+    git_run_installer: true
+
+- name: check installed version
+  when: git_cli_stat.stat.exists
+  win_command: '"{{git_cli_exe}}" --version'
+  register: git_cli_version
+  changed_when: false
+
+- when: git_cli_stat.stat.exists and git_version not in git_cli_version.stdout
+  set_fact:
+    git_run_installer: true
+
+- include_tasks: Windows-installer.yaml
+  when: git_run_installer
 
 - name: clone config repos
   win_git:
@@ -16,6 +37,7 @@
     dest: '{{ansible_env.USERPROFILE}}/.config/{{item.name}}'
     version: master
   with_items: '{{git_config_repos}}'
+  timeout: 30
 
 # - TODO: install pip packages
 #   win_pip: