diff --git a/deploy/lib.sh b/deploy/lib.sh
index f0cc28e..7d4ff5a 100644
--- a/deploy/lib.sh
+++ b/deploy/lib.sh
@@ -52,6 +52,10 @@ log() { printf '%s %s\n' "$(date -u +%H:%M:%S)" "$*" >&2; }
 die() { log "ERROR: $*"; exit 1; }
 
 [ "$(id -u)" != 0 ] || die "run as the deploy user (sudo -u deploy $0 ...), not as root"
+# `sudo -u deploy` from a root shell keeps /root as the working directory,
+# which deploy cannot read and GNU find refuses to start in. Every path here
+# is absolute, so nothing needs the caller's directory.
+cd /
 
 # acquire_lock <seconds>: deploy.sh and rollback.sh share this lock, so a CI
 # deploy and a manual rollback never run at the same time. Held until exit.