diff --git a/deploy/build.sh b/deploy/build.sh
index cc9464f..83847f1 100755
--- a/deploy/build.sh
+++ b/deploy/build.sh
@@ -5,11 +5,16 @@ set -eu
 
 VAULT="${VAULT:-/home/nox/docker/obsidian/vaults/weeslahw_coppermind}"
 
+# --user: build artifacts (node_modules, dist, public/assets) must stay
+# owned by the invoking user, or the next git pull can't write the tree
 docker run --rm \
+    --user "$(id -u):$(id -g)" \
     -v "$(pwd):/app" \
     -v "$VAULT:/content:ro" \
     -e GARDEN_CONTENT=/content/Digital_Garden \
     -e ASTRO_TELEMETRY_DISABLED=1 \
+    -e HOME=/tmp \
+    -e npm_config_cache=/tmp/.npm \
     -w /app \
     node:24-slim \
     sh -c "npm ci && npm run build"