diff --git a/cmake/CPM.cmake b/cmake/CPM.cmake
index b7d27fa..5deb6fd 100644
--- a/cmake/CPM.cmake
+++ b/cmake/CPM.cmake
@@ -3,7 +3,7 @@
 # See https://github.com/TheLartians/CPM.cmake for usage and update instructions.
 #
 # MIT License
-# ----------- 
+# -----------
 #[[
   Copyright (c) 2019 Lars Melchior
 
@@ -42,13 +42,13 @@ See https://github.com/TheLartians/CPM.cmake for more information."
     return()
   endif()
 
-  get_property(CPM_INITIALIZED GLOBAL "" PROPERTY CPM_INITIALIZED SET)   
+  get_property(CPM_INITIALIZED GLOBAL "" PROPERTY CPM_INITIALIZED SET)
   if (CPM_INITIALIZED)
     return()
   endif()
 endif()
 
-set_property(GLOBAL PROPERTY CPM_INITIALIZED true) 
+set_property(GLOBAL PROPERTY CPM_INITIALIZED true)
 
 option(CPM_USE_LOCAL_PACKAGES "Always try to use `find_package` to get dependencies" $ENV{CPM_USE_LOCAL_PACKAGES})
 option(CPM_LOCAL_PACKAGES_ONLY "Only use `find_package` to get dependencies" $ENV{CPM_LOCAL_PACKAGES_ONLY})
@@ -125,7 +125,7 @@ function(CPMFindPackage)
   cmake_parse_arguments(CPM_ARGS "" "${oneValueArgs}" "" ${ARGN})
 
   if (NOT DEFINED CPM_ARGS_VERSION)
-    if (DEFINED CPM_ARGS_GIT_TAG) 
+    if (DEFINED CPM_ARGS_GIT_TAG)
       cpm_get_version_from_git_tag("${CPM_ARGS_GIT_TAG}" CPM_ARGS_VERSION)
     endif()
   endif()
@@ -191,6 +191,7 @@ function(CPMAddPackage)
     DOWNLOAD_COMMAND
     FIND_PACKAGE_ARGUMENTS
     NO_CACHE
+    GIT_SHALLOW
   )
 
   set(multiValueArgs
@@ -202,7 +203,7 @@ function(CPMAddPackage)
   # Set default values for arguments
 
   if (NOT DEFINED CPM_ARGS_VERSION)
-    if (DEFINED CPM_ARGS_GIT_TAG) 
+    if (DEFINED CPM_ARGS_GIT_TAG)
       cpm_get_version_from_git_tag("${CPM_ARGS_GIT_TAG}" CPM_ARGS_VERSION)
     endif()
   endif()
@@ -230,6 +231,10 @@ function(CPMAddPackage)
 
   if (DEFINED CPM_ARGS_GIT_TAG)
     list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS GIT_TAG ${CPM_ARGS_GIT_TAG})
+    # If GIT_SHALLOW is explicitly specified, honor the value.
+    if (DEFINED CPM_ARGS_GIT_SHALLOW)
+      list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS GIT_SHALLOW ${CPM_ARGS_GIT_SHALLOW})
+    endif()
   endif()
 
   # Check if package has been added before
@@ -271,7 +276,7 @@ function(CPMAddPackage)
       return()
     endif()
 
-    if(CPM_LOCAL_PACKAGES_ONLY) 
+    if(CPM_LOCAL_PACKAGES_ONLY)
       message(SEND_ERROR "CPM: ${CPM_ARGS_NAME} not found via find_package(${CPM_ARGS_NAME} ${CPM_ARGS_VERSION})")
     endif()
   endif()
@@ -309,6 +314,15 @@ function(CPMAddPackage)
       list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS DOWNLOAD_COMMAND "${CMAKE_COMMAND}")
       set(PACKAGE_INFO "${download_directory}")
     else()
+      # Enable shallow clone when GIT_TAG is not a commit hash.
+      # Our guess may not be accurate, but it should guarantee no commit hash get mis-detected.
+      if (NOT DEFINED CPM_ARGS_GIT_SHALLOW)
+        cpm_is_git_tag_commit_hash(${CPM_ARGS_GIT_TAG} IS_HASH)
+        if (NOT ${IS_HASH})
+          list(APPEND CPM_ARGS_UNPARSED_ARGUMENTS GIT_SHALLOW TRUE)
+        endif()
+      endif()
+
       # remove timestamps so CMake will re-download the dependency
       file(REMOVE_RECURSE ${CMAKE_BINARY_DIR}/_deps/${lower_case_name}-subbuild)
       set(PACKAGE_INFO "${PACKAGE_INFO} -> ${download_directory}")
@@ -354,7 +368,7 @@ macro(cpm_export_variables name)
   SET(${name}_ADDED "${${name}_ADDED}" PARENT_SCOPE)
 endmacro()
 
-# declares a package, so that any call to CPMAddPackage for the 
+# declares a package, so that any call to CPMAddPackage for the
 # package name will use these arguments instead.
 # Previous declarations will not be overriden.
 macro(CPMDeclarePackage Name)
@@ -402,11 +416,11 @@ function(CPMGetPackageVersion PACKAGE OUTPUT)
   set(${OUTPUT} "${CPM_PACKAGE_${PACKAGE}_VERSION}" PARENT_SCOPE)
 endfunction()
 
-# declares a package in FetchContent_Declare 
+# declares a package in FetchContent_Declare
 function (cpm_declare_fetch PACKAGE VERSION INFO)
   message(STATUS "${CPM_INDENT} adding package ${PACKAGE}@${VERSION} (${INFO})")
 
-  if (${CPM_DRY_RUN}) 
+  if (${CPM_DRY_RUN})
     message(STATUS "${CPM_INDENT} package not declared (dry run)")
     return()
   endif()
@@ -418,7 +432,7 @@ endfunction()
 
 # returns properties for a package previously defined by cpm_declare_fetch
 function (cpm_get_fetch_properties PACKAGE)
-  if (${CPM_DRY_RUN}) 
+  if (${CPM_DRY_RUN})
     return()
   endif()
   FetchContent_GetProperties(${PACKAGE})
@@ -428,8 +442,8 @@ function (cpm_get_fetch_properties PACKAGE)
 endfunction()
 
 # downloads a previously declared package via FetchContent
-function (cpm_fetch_package PACKAGE DOWNLOAD_ONLY)  
-  if (${CPM_DRY_RUN}) 
+function (cpm_fetch_package PACKAGE DOWNLOAD_ONLY)
+  if (${CPM_DRY_RUN})
     message(STATUS "${CPM_INDENT} package ${PACKAGE} not fetched (dry run)")
     return()
   endif()
@@ -466,7 +480,7 @@ endfunction()
 # guesses the package version from a git tag
 function(cpm_get_version_from_git_tag GIT_TAG RESULT)
   string(LENGTH ${GIT_TAG} length)
-  if (length EQUAL 40) 
+  if (length EQUAL 40)
     # GIT_TAG is probably a git hash
     SET(${RESULT} 0 PARENT_SCOPE)
   else()
@@ -474,3 +488,18 @@ function(cpm_get_version_from_git_tag GIT_TAG RESULT)
     SET(${RESULT} ${CMAKE_MATCH_1} PARENT_SCOPE)
   endif()
 endfunction()
+
+# guesses if the git tag is a commit hash or an actual tag or a branch nane.
+function(cpm_is_git_tag_commit_hash GIT_TAG RESULT)
+  string(LENGTH ${GIT_TAG} length)
+  # full hash has 40 characters, and short hash has at least 7 characters.
+  if (length LESS 7 OR length GREATER 40)
+    SET(${RESULT} 0 PARENT_SCOPE)
+  else()
+    if (${GIT_TAG} MATCHES "^[a-fA-F0-9]+$")
+      SET(${RESULT} 1 PARENT_SCOPE)
+    else()
+      SET(${RESULT} 0 PARENT_SCOPE)
+    endif()
+  endif()
+endfunction()
diff --git a/test/unit/is_git_tag_commit_hash.cmake b/test/unit/is_git_tag_commit_hash.cmake
new file mode 100644
index 0000000..9216d34
--- /dev/null
+++ b/test/unit/is_git_tag_commit_hash.cmake
@@ -0,0 +1,22 @@
+cmake_minimum_required(VERSION 3.14 FATAL_ERROR)
+
+include(${CPM_PATH}/CPM.cmake)
+include(${CPM_PATH}/testing.cmake)
+
+CPM_IS_GIT_TAG_COMMIT_HASH("v1.2.3" RESULT)
+ASSERT_EQUAL("0" ${RESULT})
+
+CPM_IS_GIT_TAG_COMMIT_HASH("asio-1-12-1" RESULT)
+ASSERT_EQUAL("0" ${RESULT})
+
+CPM_IS_GIT_TAG_COMMIT_HASH("513039e3cba83284cec71287fd829865b9f423bc" RESULT)
+ASSERT_EQUAL("1" ${RESULT})
+
+CPM_IS_GIT_TAG_COMMIT_HASH("513039E3CBA83284CEC71287FD829865B9F423BC" RESULT)
+ASSERT_EQUAL("1" ${RESULT})
+
+CPM_IS_GIT_TAG_COMMIT_HASH("513039E" RESULT)
+ASSERT_EQUAL("1" ${RESULT})
+
+CPM_IS_GIT_TAG_COMMIT_HASH("513039E3CBA8" RESULT)
+ASSERT_EQUAL("1" ${RESULT})