diff --git a/.gitea/workflows/deploy-lib.sh b/.gitea/workflows/deploy-lib.sh
index 38b5fe4..d765542 100644
--- a/.gitea/workflows/deploy-lib.sh
+++ b/.gitea/workflows/deploy-lib.sh
@@ -11,7 +11,12 @@ APPLY_PRUNE="${APPLY_PRUNE:-false}"
 # Commit CI validated. Empty for a manual workflow_dispatch, which falls back to
 # the current origin/main.
 DEPLOY_SHA="${DEPLOY_SHA:-}"
-DEPLOY_SNAPSHOT_DIR="${DEPLOY_SNAPSHOT_DIR:-/var/backups/homelab-deploy}"
+# Handoff point between the apply stage (writes) and the verify stage (reads).
+# Under the deploy user's own XDG state directory rather than /var/backups: the
+# deploy is unprivileged, /var/backups does not exist on a minimal Arch host, and
+# creating it would need root — which is why the first real deploy died here with
+# "is not writable" before touching a single workload. $HOME comes from sshd.
+DEPLOY_SNAPSHOT_DIR="${DEPLOY_SNAPSHOT_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/homelab-deploy}"
 # Per-workload rollout budget and how many workloads to watch at once. The whole
 # apply job has its own timeout-minutes as a backstop.
 ROLLOUT_TIMEOUT="${ROLLOUT_TIMEOUT:-300}"
diff --git a/.gitea/workflows/ssh-run.sh b/.gitea/workflows/ssh-run.sh
index 8ab3dd9..6fb1b0a 100755
--- a/.gitea/workflows/ssh-run.sh
+++ b/.gitea/workflows/ssh-run.sh
@@ -24,7 +24,7 @@ chmod 600 "$ssh_key"
 ssh -i "$ssh_key" -p "$deploy_port" \
   -o BatchMode=yes -o StrictHostKeyChecking=accept-new \
   "${DEPLOY_USER}@${DEPLOY_HOST}" \
-  "REPO=$deploy_path APPLY_PRUNE=${APPLY_PRUNE:-false} DEPLOY_SHA=${DEPLOY_SHA:-} STAGE=$1 bash -se" <<'EOF'
+  "REPO=$deploy_path APPLY_PRUNE=${APPLY_PRUNE:-false} DEPLOY_SHA=${DEPLOY_SHA:-} DEPLOY_SNAPSHOT_DIR=${DEPLOY_SNAPSHOT_DIR:-} STAGE=$1 bash -se" <<'EOF'
 source "$REPO/.gitea/workflows/deploy-lib.sh"
 run_stage "$STAGE"
 EOF