diff --git a/scripts/push-aur.sh b/scripts/push-aur.sh
index 7f9a840..eda90f7 100755
--- a/scripts/push-aur.sh
+++ b/scripts/push-aur.sh
@@ -42,12 +42,17 @@ if ! id builder &>/dev/null; then
   useradd -m builder
   echo "builder ALL=(ALL) NOPASSWD: ALL" >>/etc/sudoers
 fi
-chown -R builder:builder "$workdir/aur"
+# The whole tree, not just aur/: mktemp -d creates $workdir as 0700 root, and
+# builder could not even enter it to run makepkg ("cd: Permission denied").
+chown -R builder:builder "$workdir"
 
 echo ":: generating .SRCINFO"
 # The sha256sum is already correct from gen-pkgbuild.py (taken from the file we
 # just uploaded), so there is no need to re-download ~1.5 GB with updpkgsums.
 sudo -u builder bash -c "cd '$workdir/aur' && makepkg --printsrcinfo > .SRCINFO"
+# Hand the tree back to root: the git commands below run as root, and git
+# refuses to work in a repository owned by another user ("dubious ownership").
+chown -R root:root "$workdir"
 
 cd "$workdir/aur"
 git config user.name "${AUR_GIT_NAME:-Asger Geel Weirsoe}"
diff --git a/scripts/record-state.sh b/scripts/record-state.sh
index 19b6bcd..c21c2de 100755
--- a/scripts/record-state.sh
+++ b/scripts/record-state.sh
@@ -28,14 +28,17 @@ with open("state.json", "w") as fh:
 print(json.dumps(state, indent=2))
 PY
 
-if git diff --quiet -- state.json; then
+# Stage first: `git diff` ignores untracked files, so on the very first run
+# (no state.json in the repo yet) it reported "unchanged" and nothing was ever
+# recorded, which would have rebuilt and republished every night.
+git add state.json
+if git diff --cached --quiet -- state.json; then
   echo ":: state.json unchanged"
   exit 0
 fi
 
 git config user.name "jasp-bin autobuilder"
 git config user.email "noreply@weircon.dk"
-git add state.json
 git commit -m "Record build of ${GITHUB_REF_NAME:-build}: $(python3 -c 'import json;print(json.load(open("state.json"))["jasp_version"])')"
 
 origin="$(git remote get-url origin)"