diff --git a/scripts/build-image.sh b/scripts/build-image.sh
index bc9858a..8f6f3a9 100755
--- a/scripts/build-image.sh
+++ b/scripts/build-image.sh
@@ -13,6 +13,8 @@ set -euo pipefail
 REGISTRY="${REGISTRY:-git.bztmon.com}"
 IMAGE="${IMAGE:-jwright/bztmon-site}"
 REF="${REGISTRY}/${IMAGE}"
+# Per-user digest file so manual (odysseus) and CI (gitea-runner) runs never collide in /tmp.
+DIGEST_FILE="${DIGEST_FILE:-${TMPDIR:-/tmp}/bztmon-site-$(id -un).digest}"
 
 cd "$(dirname "$0")/.."
 
@@ -33,9 +35,9 @@ retry buildah build --retry 3 --retry-delay 5s --layers -t "${REF}:${TAG}" -t "$
 
 if [[ "${1:-}" == "push" ]]; then
   echo ">> pushing ${REF}:${TAG}"
-  retry buildah push --digestfile /tmp/bztmon-site.digest "${REF}:${TAG}"
+  retry buildah push --digestfile "${DIGEST_FILE}" "${REF}:${TAG}"
   retry buildah push "${REF}:latest"
-  DIGEST="$(cat /tmp/bztmon-site.digest)"
+  DIGEST="$(cat "${DIGEST_FILE}")"
   echo
   echo ">> pin this in home-ops kubernetes/apps/bztmon-site/bztmon-site.yaml:"
   echo "   image: ${REF}:${TAG}@${DIGEST}"
diff --git a/scripts/bump-digest.sh b/scripts/bump-digest.sh
index 46b0d43..a55ae58 100755
--- a/scripts/bump-digest.sh
+++ b/scripts/bump-digest.sh
@@ -21,7 +21,8 @@ MANIFEST="${MANIFEST:-kubernetes/apps/bztmon-site/bztmon-site.yaml}"
 GITEA_API="${GITEA_API:-https://gitea.bztmon.org/api/v1}"
 
 TAG="$(git rev-parse --short HEAD)"
-DIGEST="$(cat /tmp/bztmon-site.digest)"
+DIGEST_FILE="${DIGEST_FILE:-${TMPDIR:-/tmp}/bztmon-site-$(id -un).digest}"
+DIGEST="$(cat "${DIGEST_FILE}")"
 REF="${REGISTRY}/${IMAGE}:${TAG}@${DIGEST}"
 echo ">> new image ref: ${REF}"