diff --git a/infra/build-server/provision.sh b/infra/build-server/provision.sh
index d372c4ace..ec27872b6 100755
--- a/infra/build-server/provision.sh
+++ b/infra/build-server/provision.sh
@@ -255,7 +255,8 @@ step_dirs() {
 step_lease_tool() {
   local src="/srv/igneum.git" want have=""
   install -d -m 755 -o "$BUILD_USER" -g "$BUILD_USER" /srv/builds/_bin
-  want=$(git -C "$src" show master:infra/build-server/lease.sh 2>/dev/null) || { ok lease-tool "mirror has no master yet; run-from-mac.sh installs it on the next provision"; return; }
+  # the mirror is build-owned: read it as build (root's git refuses a dubious-ownership repo, so build-6 never got the lease tool from this step, 8 Oct 2026)
+  want=$(as_build "git -C '$src' show master:infra/build-server/lease.sh" 2>/dev/null) || { ok lease-tool "mirror has no master yet; run-from-mac.sh installs it on the next provision"; return; }
   [ -f /srv/builds/_bin/lease ] && have=$(cat /srv/builds/_bin/lease)
   if [ "$want" = "$have" ]; then ok lease-tool "/srv/builds/_bin/lease is the mirror's master copy"; return; fi
   printf '%s\n' "$want" > /srv/builds/_bin/lease.new; chmod 755 /srv/builds/_bin/lease.new; chown "$BUILD_USER:$BUILD_USER" /srv/builds/_bin/lease.new