diff --git a/linux/build/scripts/build-inner.sh b/linux/build/scripts/build-inner.sh
index b47fb20..83a26fc 100755
--- a/linux/build/scripts/build-inner.sh
+++ b/linux/build/scripts/build-inner.sh
@@ -26,6 +26,28 @@ set -euo pipefail
 : "${REPO_ROOT:?REPO_ROOT must be set}"
 : "${BUILD_DIR:?BUILD_DIR must be set}"
 
+# Explicit user_name pin.
+# derivative-maker/help-steps/variables (lines 80-93) computes user_name
+# from $SUDO_USER as its first non-empty fallback. We enter this script
+# via `sudo --preserve-env -u user --` from root, which makes sudo set
+# SUDO_USER=root (the *calling* user). Variables.sh then picks
+# user_name="root" and computes HOMEVAR=/home/root — which doesn't exist
+# (root's home is /root). The first thing that breaks under that path
+# is the aptgetopt config tee in 1100_sanity-tests:
+#     tee: /home/root/derivative-binary/30_derivative-maker.conf:
+#     No such file or directory
+# Setting user_name explicitly satisfies the first-priority check in
+# variables.sh and short-circuits the SUDO_USER fallback.
+export user_name=user
+
+# Create the binary output directory derivative-maker writes into.
+# variables.sh sets binary_build_folder_dist=$HOMEVAR/derivative-binary
+# (= /home/user/derivative-binary), and 1100_sanity-tests / later steps
+# expect it to exist. Upstream's docker-start does the equivalent
+# `mkdir --parents -- "${HOME}/derivative-binary"`; we replicate that
+# here so we don't depend on upstream's wrapper.
+mkdir -p "${HOME}/derivative-binary"
+
 # shellcheck disable=SC1091
 source "${REPO_ROOT}/linux/build/config/silvermetal-base.conf"
 
@@ -54,13 +76,14 @@ cd "${REPO_ROOT}/linux/build/derivative-maker"
     --allow-untagged    true \
     --allow-uncommitted true
 
-# derivative-maker writes into its own build/ tree; collect into BUILD_DIR.
+# derivative-maker writes its outputs into ${HOME}/derivative-binary
+# (per help-steps/variables: binary_build_folder_dist=$HOMEVAR/derivative-binary),
+# *not* into the source tree. Collect from there into BUILD_DIR.
 # Exact upstream output paths can shift between tags — keep this tolerant.
-# Anything matching *.iso under the tree is what we want.
-find . -maxdepth 6 -type f -name "*.iso" -print0 \
+find "${HOME}/derivative-binary" -maxdepth 6 -type f -name "*.iso" -print0 \
     | xargs -0 -I{} cp -av "{}" "${BUILD_DIR}/"
 
 # Manifest of file metadata that lives inside the ISO. Useful when
 # diagnosing reproducibility regressions without re-extracting.
-find . -maxdepth 6 -type f -name "*.manifest" -print0 \
+find "${HOME}/derivative-binary" -maxdepth 6 -type f -name "*.manifest" -print0 \
     | xargs -0 -I{} cp -av "{}" "${BUILD_DIR}/" 2>/dev/null || true