diff --git a/src/applications/diffusion/conduit/DiffusionBrowseQueryConduitAPIMethod.php b/src/applications/diffusion/conduit/DiffusionBrowseQueryConduitAPIMethod.php
--- a/src/applications/diffusion/conduit/DiffusionBrowseQueryConduitAPIMethod.php
+++ b/src/applications/diffusion/conduit/DiffusionBrowseQueryConduitAPIMethod.php
@@ -229,11 +229,19 @@
         $commit);
 
       if (!$err) {
-        $tmp = new TempFile();
-        Filesystem::writeFile($tmp, $contents);
-        list($module_info) = $repository->execxLocalCommand(
-          'config -l -f %s',
-          $tmp);
+
+        // NOTE: After T13673, the user executing "git" may not be the same
+        // as the user this process is running as (usually the webserver user),
+        // so we can't reliably use a temporary file: the daemon user may not
+        // be able to use it.
+
+        // Use "--file -" to read from stdin instead. If this fails in some
+        // older versions of Git, we could exempt this particular command from
+        // sudoing to the daemon user.
+
+        $future = $repository->getLocalCommandFuture('config -l --file - --');
+        $future->write($contents);
+        list($module_info) = $future->resolvex();
 
         $dict = array();
         $lines = explode("\n", trim($module_info));