diff --git a/.woodpecker.yaml b/.woodpecker.yaml
index bc90676..711bc3a 100644
--- a/.woodpecker.yaml
+++ b/.woodpecker.yaml
@@ -48,10 +48,9 @@ steps:
       - echo "Building angie $VERSION"
       - STREAM="$(nix build .#default --print-out-paths --no-link)"
 
-      # skopeo writes intermediate files under /var/tmp by default; the
-      # nix-ci image doesn't seed that path, so point it at $HOME/tmp.
-      - mkdir -p "$HOME/tmp"
-      - export TMPDIR="$HOME/tmp"
+      # skopeo's containers/image library writes intermediate files under
+      # /var/tmp (not TMPDIR), and the nix-ci image doesn't seed that path.
+      - mkdir -p /var/tmp && chmod 1777 /var/tmp
 
       # Auth + push to Gitea OCI registry under both <ver>-arm64 and latest-arm64.
       - mkdir -p ~/.config/containers