diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index a5a7377..91bcd41 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -23,3 +23,10 @@ jobs:
 
     - name: Test
       run: go test -v ./...
+
+  integration-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Integration test
+        run: docker build -f test/Dockerfile .
diff --git a/.gitignore b/.gitignore
index e69de29..5664e30 100644
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1 @@
+git
diff --git a/main.go b/main.go
index 2f30d22..21444c6 100644
--- a/main.go
+++ b/main.go
@@ -41,7 +41,7 @@ func main() {
 	}
 }
 
-var allowedCommands = []string{"clone", "fetch"}
+var allowedCommands = []string{"clone", "fetch", "ls-remote"}
 
 // IsRewriteAllowed returns true if it is safe to rewrite arguments. Some commands
 // such as config would break if rewritten, like when using insteadOf.
@@ -89,7 +89,7 @@ func FindGit(envPath string) string {
 }
 
 var scpUrl = regexp.MustCompile(`^(?P<user>\S+?)@(?P<host>[a-zA-Z\d-]+(\.[a-zA-Z\d-]+)+\.?):(?P<path>.*?/.*?)$`)
-var allowedSchemes = []string{"git", "ssh"}
+var allowedSchemes = []string{"git", "ssh", "git+ssh"}
 
 // Scrub rewrites arguments that look like URLs to have the HTTPS protocol.
 func Scrub(argument string) string {
diff --git a/main_test.go b/main_test.go
index 51cb0a0..925a02a 100644
--- a/main_test.go
+++ b/main_test.go
@@ -19,6 +19,10 @@ func TestIsRewriteAllowed(t *testing.T) {
 			input:    []string{"fetch", ""},
 			expected: true,
 		},
+		{
+			input:    []string{"ls-remote", ""},
+			expected: true,
+		},
 		{
 			input:    []string{"--work-tree=/work", "clone"},
 			expected: true,
@@ -51,6 +55,14 @@ func TestScrub(t *testing.T) {
 			input:    "git@github.com:dependabot/git-https-shim",
 			expected: "https://github.com/dependabot/git-https-shim",
 		},
+		{
+			input:    "git+ssh://git@github.com/dependabot/git-https-shim",
+			expected: "https://github.com/dependabot/git-https-shim",
+		},
+		{
+			input:    "git+ssh://user:pass@github.com/dependabot/git-https-shim",
+			expected: "https://user:pass@github.com/dependabot/git-https-shim",
+		},
 		{
 			input:    "ssh://user:pass@github.com/dependabot/git-https-shim",
 			expected: "https://user:pass@github.com/dependabot/git-https-shim",