diff --git a/site-cookbooks/kosmos-mastodon/recipes/build.rb b/site-cookbooks/kosmos-mastodon/recipes/build.rb
index ea369e0..839802f 100644
--- a/site-cookbooks/kosmos-mastodon/recipes/build.rb
+++ b/site-cookbooks/kosmos-mastodon/recipes/build.rb
@@ -179,13 +179,15 @@ execute "rake assets:precompile" do
   cwd mastodon_path
   command "bundle exec rake assets:precompile"
   not_if build_uptodate
-  notifies :create, "file[#{mastodon_path}/tmp/built-revision]", :immediately
+  notifies :run, "execute[record built revision]", :immediately
 end
 
-file "#{mastodon_path}/tmp/built-revision" do
-  content lazy { `git -C #{mastodon_path} rev-parse HEAD`.strip }
-  owner mastodon_user
-  group mastodon_user
-  mode  "0644"
-  action :nothing
+# Record the built revision. Runs as the mastodon user so git accepts the repo
+# (a root-run `git` would refuse due to dubious ownership).
+execute "record built revision" do
+  user    mastodon_user
+  group   mastodon_user
+  cwd     mastodon_path
+  command "git rev-parse HEAD > tmp/built-revision"
+  action  :nothing
 end
diff --git a/site-cookbooks/kosmos-mastodon/recipes/deploy.rb b/site-cookbooks/kosmos-mastodon/recipes/deploy.rb
index 8346257..aebac8f 100644
--- a/site-cookbooks/kosmos-mastodon/recipes/deploy.rb
+++ b/site-cookbooks/kosmos-mastodon/recipes/deploy.rb
@@ -131,7 +131,7 @@ execute "tootctl search deploy (create indices)" do
   timeout 3_600
   action :nothing
   notifies :run, "execute[start mastodon search deploy]", :immediately
-  notifies :create, "file[#{mastodon_path}/tmp/deployed-revision]", :immediately
+  notifies :run, "execute[record deployed revision]", :immediately
 end
 
 execute "start mastodon search deploy" do
@@ -139,12 +139,14 @@ execute "start mastodon search deploy" do
   action :nothing
 end
 
-file "#{mastodon_path}/tmp/deployed-revision" do
-  content lazy { `git -C #{mastodon_path} rev-parse HEAD`.strip }
-  owner mastodon_user
-  group mastodon_user
-  mode  "0644"
-  action :nothing
+# Record the deployed revision. Runs as the mastodon user so git accepts the
+# repo (a root-run `git` would refuse due to dubious ownership).
+execute "record deployed revision" do
+  user    mastodon_user
+  group   mastodon_user
+  cwd     mastodon_path
+  command "git rev-parse HEAD > tmp/deployed-revision"
+  action  :nothing
 end
 
 service "mastodon-web" do