diff --git a/.gitea/workflows/base-build.yml b/.gitea/workflows/base-build.yml
index bf564a1..5b6587b 100644
--- a/.gitea/workflows/base-build.yml
+++ b/.gitea/workflows/base-build.yml
@@ -130,18 +130,29 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
+      - name: Ensure output directory exists
+        run: mkdir -p ${{ env.OUTPUT_DIR }}/${{ matrix.version }}
+
       - name: Build rootfs tarball
         run: |
           VERSION=${{ matrix.version }}
+          OUT_DIR=${{ env.OUTPUT_DIR }}/$VERSION
 
           docker build \
             --build-arg VERSION="$VERSION" \
             -t rootfs-$VERSION .
 
-          docker run --rm rootfs-$VERSION \
-            bash -c "/scripts/bootstrap-rootfs.sh $VERSION"
+          docker run --rm \
+            -v "$(pwd)/$OUT_DIR:/output" \
+            rootfs-$VERSION \
+            bash -c "/scripts/bootstrap-rootfs.sh $VERSION /output"
 
-          test -f "debian-$VERSION.tar.bz2"
+          if [[ ! -f "$OUT_DIR/debian-$VERSION.tar.bz2" ]]; then
+            echo "[ERROR] Rootfs tarball not found at $OUT_DIR/debian-$VERSION.tar.bz2"
+            exit 1
+          else
+            echo "[OK] Rootfs tarball created at $OUT_DIR/debian-$VERSION.tar.bz2"
+          fi
 
       - name: Clone upload repo
         run: |
@@ -151,11 +162,13 @@ jobs:
       - name: Update archive + sha256
         run: |
           VERSION=${{ matrix.version }}
+          OUT_DIR=${{ env.OUTPUT_DIR }}/$VERSION
 
           mkdir -p upload/$VERSION
-          cp "debian-$VERSION.tar.bz2" "upload/$VERSION/"
+          cp "$OUT_DIR/debian-$VERSION.tar.bz2" "upload/$VERSION/"
 
           cd upload
+          # Remove previous sha256 entry for this version
           sed -i "/debian-$VERSION.tar.bz2/d" sha256sums.txt 2>/dev/null || true
           sha256sum "$VERSION/debian-$VERSION.tar.bz2" >> sha256sums.txt