diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 23936f4..d1b9318 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -226,10 +226,13 @@ jobs:
               -o unitdore .
 
             PKGDIR="unitdore_${PKGVER}_${GOARCH}"
-            mkdir -p "${PKGDIR}/DEBIAN"
-            mkdir -p "${PKGDIR}/usr/bin"
-            mkdir -p "${PKGDIR}/usr/share/man/man1"
-            mkdir -p "${PKGDIR}/etc/unitdore"
+            # explicit modes: the runner umask can make mkdir -p create 777 dirs,
+            # which dpkg-deb rejects
+            install -d -m755 \
+              "${PKGDIR}/DEBIAN" \
+              "${PKGDIR}/usr/bin" \
+              "${PKGDIR}/usr/share/man/man1" \
+              "${PKGDIR}/etc/unitdore"
 
             install -m755 unitdore "${PKGDIR}/usr/bin/unitdore"
             install -m644 docs/unitdore.1 "${PKGDIR}/usr/share/man/man1/unitdore.1"
@@ -237,6 +240,7 @@ jobs:
             sed -e "s/VERSION/${PKGVER}/" \
                 -e "s/ARCH/${GOARCH}/" \
                 pkg/debian/control > "${PKGDIR}/DEBIAN/control"
+            chmod 644 "${PKGDIR}/DEBIAN/control"
 
             dpkg-deb --build --root-owner-group "${PKGDIR}"
             echo "Built ${PKGDIR}.deb"