diff --git a/flake.nix b/flake.nix
index 998a9b5..4f86c51 100644
--- a/flake.nix
+++ b/flake.nix
@@ -79,8 +79,11 @@
                 # 3) tar the payload OUTSIDE $PAY to avoid self-inclusion
                 _TMP="$(mktemp -d)"
                 ( cd "$PAY" && tar \
+                  --owner=0 --group=0 \
+                  --mode=u+rw,uga+r \
+                  --hard-dereference \
+                  --format=gnu \
                   --sort=name \
-                  --owner=0 --group=0 --numeric-owner \
                   -czf "$_TMP/payload.tar.gz" . )
 
                 # 4) write the self-extracting stub