diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 53d8d10..484a0c0 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -123,6 +123,9 @@ jobs:
 
       - name: Build .deb packages
         run: |
+          set -euo pipefail
+          # Runner umask can be 000; dpkg-deb rejects group/world-writable package dirs.
+          umask 022
           VERSION="${{ github.event.inputs.tag || github.ref_name }}"
           PKGVER="${VERSION#v}"