diff --git a/packages/kmp/build.gradle.kts b/packages/kmp/build.gradle.kts
index d48c6d25..1f4177ac 100644
--- a/packages/kmp/build.gradle.kts
+++ b/packages/kmp/build.gradle.kts
@@ -12,12 +12,21 @@ version = providers.gradleProperty("VERSION_NAME").orElse(
         // derive a snapshot version by patch-bumping the latest git tag. Any
         // failure — git missing, shallow/tagless clone, or an unexpected tag
         // format — degrades to 0.0.1-SNAPSHOT instead of breaking configuration.
+        //
+        // Uses providers.exec rather than ProcessBuilder: starting a process
+        // directly at configuration time is rejected outright under the
+        // configuration cache ("external process started 'git describe …' …
+        // is unsupported"), which made this build impossible to run with
+        // --configuration-cache. providers.exec records the invocation as a
+        // configuration-cache input instead.
         val tag = runCatching {
-            val process = ProcessBuilder("git", "describe", "--tags", "--abbrev=0")
-                .directory(rootDir)
-                .start()
-            val out = process.inputStream.bufferedReader().readText().trim()
-            if (process.waitFor() == 0) out else ""
+            providers.exec {
+                workingDir = rootDir
+                commandLine("git", "describe", "--tags", "--abbrev=0")
+                // A tagless or shallow clone exits non-zero; fall through to
+                // the 0.0.0 defaults below rather than failing the build.
+                isIgnoreExitValue = true
+            }.standardOutput.asText.get().trim()
         }.getOrDefault("")
 
         val parts = tag.removePrefix("v").split(".")