diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 1a1cbe357..9c107a376 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -371,46 +371,45 @@ jobs:
   # ------------------------------------------------------------------
   rpm:
     runs-on: warp-ubuntu-latest-x64-16x
-    container:
-      image: fedora:latest
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: true
 
-      - name: Install dependencies
+      - name: Build package in Fedora container
         run: |
-          dnf install -y \
-            cmake ninja-build pkgconf-pkg-config \
-            qt6-qtbase-devel qt6-qtbase-private-devel qt6-qttools-devel \
-            ffmpeg-free-devel \
-            OpenImageIO-devel \
-            OpenColorIO-devel \
-            openexr-devel \
-            expat-devel \
-            portaudio-devel \
-            mesa-libGL-devel \
-            vulkan-headers \
-            vulkan-loader-devel \
-            libxkbcommon-devel \
-            gcc-c++ \
-            bzip2-devel \
-            rpm-build
-
-      - name: Build
-        run: |
-          cmake -S . -B build -G Ninja \
-            -DCMAKE_BUILD_TYPE=Release \
-            -DCMAKE_INSTALL_PREFIX=/usr \
-            -DBUILD_QT6=ON \
-            -DCMAKE_DISABLE_FIND_PACKAGE_Vulkan=ON
-          cmake --build build
-
-      - name: Create RPM package
-        run: |
-          cd build
-          cpack -G RPM
-          mv *.rpm "${GITHUB_WORKSPACE}/"
+          docker run --rm \
+            -v "${PWD}:/build" \
+            -w /build \
+            fedora:latest \
+            bash -c '
+              set -e
+              dnf install -y \
+                cmake ninja-build pkgconf-pkg-config \
+                qt6-qtbase-devel qt6-qtbase-private-devel qt6-qttools-devel \
+                ffmpeg-free-devel \
+                OpenImageIO-devel \
+                OpenColorIO-devel \
+                openexr-devel \
+                expat-devel \
+                portaudio-devel \
+                mesa-libGL-devel \
+                vulkan-headers \
+                vulkan-loader-devel \
+                libxkbcommon-devel \
+                gcc-c++ \
+                bzip2-devel \
+                rpm-build
+              cmake -S . -B build -G Ninja \
+                -DCMAKE_BUILD_TYPE=Release \
+                -DCMAKE_INSTALL_PREFIX=/usr \
+                -DBUILD_QT6=ON \
+                -DCMAKE_DISABLE_FIND_PACKAGE_Vulkan=ON
+              cmake --build build
+              cd build
+              cpack -G RPM
+              mv *.rpm /build/
+            '
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4
@@ -433,11 +432,14 @@ jobs:
           VERSION="${GITHUB_REF_NAME#v}"
           # Arch pkgver cannot contain hyphens
           PKGVER="${VERSION//-/_}"
-          tar czf "oak-video-editor-${PKGVER}.tar.gz" \
+          TARBALL="oak-video-editor-${PKGVER}.tar.gz"
+          tar czf "/tmp/${TARBALL}" \
             --transform "s,^,oak-video-editor-${PKGVER}/," \
             --exclude='.git' \
             --exclude='build' \
+            --exclude='*.tar.gz' \
             .
+          mv "/tmp/${TARBALL}" "${TARBALL}"
           sed "s/@VERSION@/${PKGVER}/g" app/packaging/arch/PKGBUILD.in > PKGBUILD
 
       - name: Build package in Arch Linux container