diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 3987b0a..81b443f 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -147,8 +147,30 @@ jobs:
           fi
           echo "public URL serves the expected bytes"
 
-      # Only the PKGBUILD and metadata cross the job boundary — the tarball
-      # itself already lives on GitHub Releases.
+      # The same PKGBUILD the AUR gets, next to the tarball, so the copy on
+      # the tarball host always matches the AUR package. Written to a dotfile
+      # first and renamed, so the host's index never sees a half-written file.
+      # Cosmetic for the AUR release, so a failure here does not stop it.
+      - name: Publish PKGBUILD next to the tarball
+        if: vars.PUBLISH == 'true'
+        continue-on-error: true
+        env:
+          TARBALL_SSH_KEY: ${{ secrets.TARBALL_SSH_KEY }}
+          TARBALL_HOST: ${{ secrets.TARBALL_HOST }}
+          TARBALL_PATH: ${{ secrets.TARBALL_PATH }}
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "$TARBALL_SSH_KEY" > ~/.ssh/pkgbuild_key
+          chmod 600 ~/.ssh/pkgbuild_key
+          dest="${TARBALL_PATH}/jasp-desktop-bin.PKGBUILD"
+          ssh -i ~/.ssh/pkgbuild_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
+            "root@${TARBALL_HOST}" \
+            "cat > '${TARBALL_PATH}/.jasp-desktop-bin.PKGBUILD.part' && mv '${TARBALL_PATH}/.jasp-desktop-bin.PKGBUILD.part' '$dest' && chmod 644 '$dest'" \
+            < PKGBUILD
+          echo "PKGBUILD published next to the tarball"
+
+      # Only the PKGBUILD and metadata cross the job boundary; the tarball
+      # itself already lives on the tarball host.
       - name: Hand PKGBUILD to the AUR job
         if: vars.PUBLISH == 'true'
         uses: actions/upload-artifact@v3