diff --git a/mc-service-setup.sh b/mc-service-setup.sh
index 125c5cd..a711286 100755
--- a/mc-service-setup.sh
+++ b/mc-service-setup.sh
@@ -130,9 +130,17 @@ if [ -n "$NFVER" ]; then
     curl -fsSL -o "$tmp/installer.jar" "$url" \
         || die "could not download $url — check the version number exists"
 
+    # mktemp -d gives root a 0700 directory, so the service user cannot read the
+    # jar out of it. Open up the path — the installer is a public download.
+    chmod 0755 "$tmp"
+    chmod 0644 "$tmp/installer.jar"
+
     # The installer writes into the working directory, so run it as the service
-    # user to avoid leaving root-owned files scattered through the share.
-    ( cd "$SHARE" && runuser -u "$MCUSER" -- java -jar "$tmp/installer.jar" --installServer ) \
+    # user to avoid leaving root-owned files scattered through the share. HOME is
+    # set explicitly because runuser otherwise leaves root's, and the installer
+    # writes a cache next to it.
+    ( cd "$SHARE" && runuser -u "$MCUSER" -- \
+        env HOME="$SHARE" java -jar "$tmp/installer.jar" --installServer ) \
         || die "NeoForge installer failed"
     rm -rf "$tmp"; trap - EXIT
 fi