diff --git a/.forgejo/testdata/build-release/modules/public/bindata.go b/.forgejo/testdata/build-release/modules/public/bindata.go
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/.forgejo/testdata/build-release/public/css/placeholder b/.forgejo/testdata/build-release/public/css/placeholder
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/.forgejo/testdata/build-release/public/fonts/placeholder b/.forgejo/testdata/build-release/public/fonts/placeholder
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/.forgejo/testdata/build-release/public/js/placeholder b/.forgejo/testdata/build-release/public/js/placeholder
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml
index 80be728a8f..c2c0235d4d 100644
--- a/.forgejo/workflows/build-release.yml
+++ b/.forgejo/workflows/build-release.yml
@@ -69,20 +69,51 @@ jobs:
           set -x
           apt-get -qq install -y make
           version=${{ steps.tag-version.outputs.value }}
-          make VERSION=$version sources-tarbal
+          #
+          # Make sure all files are owned by the current user.
+          # When run as root `npx webpack` will assume the identity
+          # of the owner of the current working directory and may
+          # fail to create files if some sub-directories are not owned
+          # by the same user.
+          #
+          #   Binaries:
+          #   Node: 18.17.0 - /usr/local/node-v18.17.0-linux-x64/bin/node
+          #   npm: 9.6.7 - /usr/local/node-v18.17.0-linux-x64/bin/npm
+          # Packages:
+          #   add-asset-webpack-plugin: 2.0.1 => 2.0.1
+          #   css-loader: 6.8.1 => 6.8.1
+          #   esbuild-loader: 3.0.1 => 3.0.1
+          #   license-checker-webpack-plugin: 0.2.1 => 0.2.1
+          #   monaco-editor-webpack-plugin: 7.0.1 => 7.0.1
+          #   vue-loader: 17.2.2 => 17.2.2
+          #   webpack: 5.87.0 => 5.87.0
+          #   webpack-cli: 5.1.4 => 5.1.4
+          #
+          chown -R $(id -u) .
+          make VERSION=$version TAGS=bindata sources-tarbal
           mv dist/release release
 
-          #
-          # Sanity check to verify that the source tarbal knows the
-          # version and is able to rebuild itself from it.
-          #
-          # When in sources the version is determined with git.
-          # When in the tarbal the version is determined from a VERSION file.
-          #
           (
             tmp=$(mktemp -d)
             tar --directory $tmp -zxvf release/*$version*.tar.gz
             cd $tmp/*
+            #
+            # Verify `make frontend` files are available
+            #
+            test -d public/css
+            test -d public/fonts
+            test -d public/js
+            #
+            # Verify `make generate` files are available
+            #
+            test -d modules/public/bindata.go
+            #
+            # Sanity check to verify that the source tarbal knows the
+            # version and is able to rebuild itself from it.
+            #
+            # When in sources the version is determined with git.
+            # When in the tarbal the version is determined from a VERSION file.
+            #
             make sources-tarbal
             tarbal=$(echo dist/release/*$version*.tar.gz)
             if ! test -f $tarbal ; then
diff --git a/Makefile b/Makefile
index 057196b131..d60afb60f7 100644
--- a/Makefile
+++ b/Makefile
@@ -818,7 +818,8 @@ static-executable: $(GO_SOURCES) $(TAGS_PREREQ)
 .PHONY: release
 release: frontend generate release-linux release-copy release-compress vendor release-sources release-check
 
-sources-tarbal: vendor release-sources release-check
+# just the sources, with all assets builtin and frontend resources generated
+sources-tarbal: frontend generate vendor release-sources release-check
 
 $(DIST_DIRS):
 	mkdir -p $(DIST_DIRS)