diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index d9fb1e4..dc30fc1 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -90,7 +90,10 @@ jobs:
           path: prepare
           pattern: um-*
       - name: repack archive
-        run: ./misc/repack.sh "${{ steps.vars.outputs.git_tag }}"
+        run: |
+          apt-get update
+          apt-get install -y strip-nondeterminism
+          ./misc/repack.sh "${{ steps.vars.outputs.git_tag }}"
       - name: Publish all-in-one archive
         uses: christopherhx/gitea-upload-artifact@v4
         with:
diff --git a/misc/repack.sh b/misc/repack.sh
index 64761af..7a8f9a6 100755
--- a/misc/repack.sh
+++ b/misc/repack.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash -e
 # see .gitea/workflows/build.yml
 
 APP_VERSION="${1:-$(git describe --tags --always)}"
@@ -8,7 +8,8 @@ for exe in prepare/*/um-*.exe; do
     new_exe="$(dirname "$exe")/um.exe"
     mv "$exe" "$new_exe"
 
-    zip -9 -j "dist/${name}.zip" "$new_exe"
+    echo "archiving ${new_exe}..."
+    zip -Xqj9 "dist/${name}.zip" "$new_exe"
     rm -f "$new_exe"
 done
 
@@ -17,6 +18,7 @@ for exe in prepare/*/um-*; do
     new_exe="$(dirname "$exe")/um"
     mv "$exe" "$new_exe"
 
+    echo "archiving ${new_exe}..."
     tar \
         --sort=name --format=posix \
         --pax-option=exthdr.name=%d/PaxHeaders/%f \
@@ -24,11 +26,18 @@ for exe in prepare/*/um-*; do
         --clamp-mtime --mtime='1970-01-01T00:00:00Z' \
         --numeric-owner --owner=0 --group=0 \
         --mode=0755 \
-        -cv -C "$(dirname "$exe")" um |
+        -c -C "$(dirname "$exe")" um |
         gzip -9 >"dist/${name}.tar.gz"
     rm -f "$exe"
 done
 
 pushd dist
+
+if command -v strip-nondeterminism >/dev/null 2>&1; then
+    echo 'strip archives...'
+    strip-nondeterminism *.zip *.tar.gz
+fi
+
+echo 'Creating checksum...'
 sha256sum *.zip *.tar.gz >sha256sum.txt
 popd