Okay so using

-c protocol.version=2

does fix the issue for every repository except one, which is hosted by gitlab. afaict gitlab doesn't support

allowAnySHA1InWant

over https connections (https://gitlab.com/gitlab-org/gitaly/issues/1553). Not sure why it would work with an earlier version of git though? Maybe I'm misunderstanding something?