diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index e4a114c..42fb6f1 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -29,6 +29,15 @@ jobs:
       SCCACHE_DIR: /var/local/sccache
       SCCACHE_SERVER_PORT: "4228"
       CARGO_TARGET_DIR: /var/local/cargo-target
+      # cargo-leptos's own downloaded tools (wasm-bindgen, wasm-opt) cache
+      # under $XDG_CACHE_HOME - left at its default that resolves inside
+      # this unit's systemd StateDirectory, files it creates there end up
+      # owned by the kernel's overflow "nobody" uid instead of the
+      # runner's own dynamic uid (a StateDirectory quirk, not something
+      # in our control), so a later run can't execute what an earlier run
+      # downloaded. Redirecting it to our own known-good shared dir avoids
+      # that entirely.
+      XDG_CACHE_HOME: /var/local/leptos-cache
     steps:
       - uses: actions/checkout@v4