diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f4e3457..134d6eb 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -255,7 +255,9 @@ jobs:
           # /usr/lib/udev and present only under the junk path — so the fork's
           # udev quirks had never once been applied on the device.
           # Fold any leaked tree back before the tar, then refuse to ship a
-          # tree containing anything but usr/ and etc/.
+          # tree containing anything but the three prefixes upower legitimately
+          # installs into: usr/, etc/ (UPower.conf) and var/ (var/lib/upower).
+          # Leaving var/ out of that list is what failed run 1234.
           DEST="$GITHUB_WORKSPACE/src/upower/dest-aarch64"
           LEAK="$DEST$HOME/aarch64-sysroot"
           if [ -d "$LEAK" ]; then
@@ -263,9 +265,10 @@ jobs:
             cp -a "$LEAK/." "$DEST/"
             rm -rf "$LEAK"
           fi
-          stray=$(find "$DEST" -mindepth 1 -maxdepth 1 ! -name usr ! -name etc -printf '%f\n')
+          stray=$(find "$DEST" -mindepth 1 -maxdepth 1 \
+                    ! -name usr ! -name etc ! -name var -printf '%f\n')
           if [ -n "$stray" ]; then
-            echo "upower tree would ship outside usr/ and etc/: $stray" >&2
+            echo "upower tree would ship outside usr/, etc/ and var/: $stray" >&2
             exit 1
           fi
           # And the rules must have landed where udev actually reads them.
diff --git a/packaging/arch/PKGBUILD.upower.prebuilt b/packaging/arch/PKGBUILD.upower.prebuilt
index 0966b9d..25c2f86 100644
--- a/packaging/arch/PKGBUILD.upower.prebuilt
+++ b/packaging/arch/PKGBUILD.upower.prebuilt
@@ -35,8 +35,10 @@ package() {
     # would put /home/<user>/aarch64-sysroot/... on the device and leave udev
     # with no rules (measured on the phone 2026-07-27). Fail loudly instead.
     local stray
-    stray=$(find "$pkgdir" -mindepth 1 -maxdepth 1 ! -name usr ! -name etc -printf '%f\n')
-    [[ -z $stray ]] || { error "upower tree ships outside usr/ and etc/: %s" "$stray"; return 1; }
+    # usr/, etc/ (UPower.conf) and var/ (var/lib/upower) are all legitimate.
+    stray=$(find "$pkgdir" -mindepth 1 -maxdepth 1 \
+              ! -name usr ! -name etc ! -name var -printf '%f\n')
+    [[ -z $stray ]] || { error "upower tree ships outside usr/, etc/ and var/: %s" "$stray"; return 1; }
     # Keep the canonical interface XML discoverable for introspection.
     install -Dm644 "$srcdir/org.freedesktop.UPower.Device.xml" \
         "$pkgdir/usr/share/dbus-1/interfaces/org.freedesktop.UPower.Device.xml"