diff --git a/.tangled/workflows/release.yml b/.tangled/workflows/release.yml
index ce12e58..00bfcbe 100644
--- a/.tangled/workflows/release.yml
+++ b/.tangled/workflows/release.yml
@@ -43,10 +43,9 @@ steps:
   - name: "Push to atcr.io"
     command: |
       set -euo pipefail
-      # skopeo unpacks the archive under $TMPDIR (default /var/tmp, which the
-      # minimal Nix step image lacks); point it at the writable workspace.
-      export TMPDIR="$PWD/.skopeo-tmp"
-      mkdir -p "$TMPDIR"
+      # skopeo (containers/image) hardcodes /var/tmp for unpacking the archive
+      # and ignores $TMPDIR; the minimal Nix step image lacks it, so create it.
+      mkdir -p /var/tmp
       image="atcr.io/${ATCR_HANDLE}/deepsky"
       tag="${TANGLED_REF_NAME}"   # the pushed tag, e.g. v1.2.3
       creds="${ATCR_HANDLE}:${ATCR_APP_PASSWORD}"