Restricting access to just CVS and Git commands

At work we have a server which hosts our CVS repository and in order to restrict shell access to this system, I have deployed [rssh](http://www.pizzashack.org/rssh/) which has worked well for a number of years. We are now converting part of our repository to Git and using this existing server to host a centralized bare Git repository. I would like to extend these restrictions to Git commands as well, but rssh does not support Git. I know that Git has [git-shell](http://git-scm.com/docs/git-shell.html) which does a similar thing for Git (though I haven't used it) but I don't think it understands CVS. Given that both approaches use the mechanism of setting the user's shell to one of these, I can't use them both at the same time. We still need to use the CVS repository so **is there any mechanism that would work for both CVS and Git?** My options at the moment are: * Do nothing (not really an option). * Find a way to make them both work (hence this question). * Forget security and just give everyone shell access. * Abandon the idea and put the central Git repository on another server (probably virtual) and use git-shell. * Something else which I haven't thought of.