diff --git a/.gitea/workflows/build-iso.yaml b/.gitea/workflows/build-iso.yaml
index 39269da..1c42842 100644
--- a/.gitea/workflows/build-iso.yaml
+++ b/.gitea/workflows/build-iso.yaml
@@ -41,14 +41,19 @@ jobs:
       - name: Install archiso and dependencies
         run: |
           set -euo pipefail
-          # The host's /etc/pacman.conf is shared, mutable state: the tests
-          # workflow appends [cachyos] and [chaotic-aur] to it, so without this
-          # reset the build would sync two repos the host never needs (it only
-          # installs archiso/jq from extra — mkarchiso reads the *profile's*
-          # pacman.conf). Every extra repo is another DNS lookup, and the
-          # gateway intermittently drops UDP/53 (that is what failed run 131
-          # at this very step). Reset to stock core/extra.
-          cat > /etc/pacman.conf << 'STOCKCONF'
+          # Install with a *private* config instead of /etc/pacman.conf.
+          # The host config is shared mutable state: the tests workflow
+          # rewrites it and jobs overlap on this runner (runs 132 and 133
+          # ran concurrently), so writing it here could corrupt a concurrent
+          # tests run. It also carries [cachyos] and [chaotic-aur] leftovers
+          # from tests.yaml, and syncing those two repos means extra DNS
+          # lookups against a gateway that intermittently drops UDP/53 —
+          # that is what failed run 131 at this very step. The build only
+          # needs archiso/jq from extra; mkarchiso reads the *profile's*
+          # pacman.conf for everything that goes into the ISO.
+          BUILD_CONF=$(mktemp)
+          trap 'rm -f "$BUILD_CONF"' EXIT
+          cat > "$BUILD_CONF" << 'STOCKCONF'
           [options]
           DisableSandbox
           HoldPkg     = pacman glibc
@@ -64,9 +69,7 @@ jobs:
           [extra]
           Include = /etc/pacman.d/mirrorlist
           STOCKCONF
-          sed -i 's/^          //' /etc/pacman.conf
-          # Drop sync databases of the custom repos so they cannot linger
-          rm -f /var/lib/pacman/sync/cachyos* /var/lib/pacman/sync/chaotic*
+          sed -i 's/^          //' "$BUILD_CONF"
 
           # Warm the resolver cache for the mirrors we are about to query.
           # systemd-resolved serves later lookups from cache, so a gateway
@@ -86,7 +89,7 @@ jobs:
           # the whole job, so retry with backoff before giving up.
           synced=0
           for try in 1 2 3 4 5; do
-            if pacman -Syu --noconfirm --needed archiso jq; then
+            if pacman --config "$BUILD_CONF" -Syu --noconfirm --needed archiso jq; then
               synced=1
               break
             fi