diff --git a/ZB.MOM.WW.Audit/build/pack.sh b/ZB.MOM.WW.Audit/build/pack.sh
index 68d2b48..36166ff 100755
--- a/ZB.MOM.WW.Audit/build/pack.sh
+++ b/ZB.MOM.WW.Audit/build/pack.sh
@@ -1,4 +1,10 @@
 #!/usr/bin/env bash
 # pack.sh — produce the ZB.MOM.WW.Audit NuGet package into ./artifacts.
 set -euo pipefail
-dotnet pack -c Release -o ./artifacts
+# cd to the repo root and name the solution + an absolute output path: `dotnet pack` with
+# neither a project argument nor a fixed working directory packs whatever solution happens
+# to sit in the CALLER's directory (the bug behind the LocalDb feed incident, 0038d46).
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+dotnet pack ZB.MOM.WW.Audit.slnx -c Release -o "$REPO_ROOT/artifacts"
diff --git a/ZB.MOM.WW.Audit/build/push.sh b/ZB.MOM.WW.Audit/build/push.sh
index a9f5a77..6937805 100755
--- a/ZB.MOM.WW.Audit/build/push.sh
+++ b/ZB.MOM.WW.Audit/build/push.sh
@@ -16,9 +16,20 @@ set -euo pipefail
 : "${GITEA_NUGET_SOURCE:?set GITEA_NUGET_SOURCE to your Gitea NuGet feed URL}"
 : "${GITEA_NUGET_KEY:?set GITEA_NUGET_KEY to your Gitea access token}"
 
-dotnet pack -c Release -o ./artifacts
+# Named solution, named output, and a cd to the repo root, all for one reason: `dotnet pack`
+# with neither a project argument nor a fixed working directory packs whatever solution
+# happens to sit in the CALLER's directory — and then pushes it to a live feed under this
+# script's name. Invoked by absolute path from another repo's checkout, the relative form
+# packed and published 25 unrelated packages (LocalDb's copy of this script, fixed in
+# 0038d46; recovered with `dotnet nuget delete`, but only because the token happened to
+# carry delete rights). A publish script must be unambiguous about WHAT it publishes no
+# matter where it is run.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
 
-dotnet nuget push "./artifacts/*.nupkg" \
+dotnet pack ZB.MOM.WW.Audit.slnx -c Release -o "$REPO_ROOT/artifacts"
+
+dotnet nuget push "$REPO_ROOT/artifacts/*.nupkg" \
   --source "$GITEA_NUGET_SOURCE" \
   --api-key "$GITEA_NUGET_KEY" \
   --skip-duplicate
diff --git a/ZB.MOM.WW.Auth/build/pack.sh b/ZB.MOM.WW.Auth/build/pack.sh
index 471e865..5f3e422 100755
--- a/ZB.MOM.WW.Auth/build/pack.sh
+++ b/ZB.MOM.WW.Auth/build/pack.sh
@@ -6,4 +6,10 @@
 
 set -euo pipefail
 
-dotnet pack -c Release -o ./artifacts
+# cd to the repo root and name the solution + an absolute output path: `dotnet pack` with
+# neither a project argument nor a fixed working directory packs whatever solution happens
+# to sit in the CALLER's directory (the bug behind the LocalDb feed incident, 0038d46).
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+dotnet pack ZB.MOM.WW.Auth.slnx -c Release -o "$REPO_ROOT/artifacts"
diff --git a/ZB.MOM.WW.Auth/build/push.sh b/ZB.MOM.WW.Auth/build/push.sh
index c4a2a55..3d0e069 100755
--- a/ZB.MOM.WW.Auth/build/push.sh
+++ b/ZB.MOM.WW.Auth/build/push.sh
@@ -16,9 +16,20 @@ set -euo pipefail
 : "${GITEA_NUGET_SOURCE:?set GITEA_NUGET_SOURCE to your Gitea NuGet feed URL}"
 : "${GITEA_NUGET_KEY:?set GITEA_NUGET_KEY to your Gitea access token}"
 
-dotnet pack -c Release -o ./artifacts
+# Named solution, named output, and a cd to the repo root, all for one reason: `dotnet pack`
+# with neither a project argument nor a fixed working directory packs whatever solution
+# happens to sit in the CALLER's directory — and then pushes it to a live feed under this
+# script's name. Invoked by absolute path from another repo's checkout, the relative form
+# packed and published 25 unrelated packages (LocalDb's copy of this script, fixed in
+# 0038d46; recovered with `dotnet nuget delete`, but only because the token happened to
+# carry delete rights). A publish script must be unambiguous about WHAT it publishes no
+# matter where it is run.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
 
-dotnet nuget push "./artifacts/*.nupkg" \
+dotnet pack ZB.MOM.WW.Auth.slnx -c Release -o "$REPO_ROOT/artifacts"
+
+dotnet nuget push "$REPO_ROOT/artifacts/*.nupkg" \
   --source "$GITEA_NUGET_SOURCE" \
   --api-key "$GITEA_NUGET_KEY" \
   --skip-duplicate
diff --git a/ZB.MOM.WW.Secrets/build/push.sh b/ZB.MOM.WW.Secrets/build/push.sh
index 5454f4e..0230c12 100755
--- a/ZB.MOM.WW.Secrets/build/push.sh
+++ b/ZB.MOM.WW.Secrets/build/push.sh
@@ -16,9 +16,20 @@ set -euo pipefail
 : "${GITEA_NUGET_SOURCE:?set GITEA_NUGET_SOURCE to your Gitea NuGet feed URL}"
 : "${GITEA_NUGET_KEY:?set GITEA_NUGET_KEY to your Gitea access token}"
 
-dotnet pack -c Release -o ./artifacts
+# Named solution, named output, and a cd to the repo root, all for one reason: `dotnet pack`
+# with neither a project argument nor a fixed working directory packs whatever solution
+# happens to sit in the CALLER's directory — and then pushes it to a live feed under this
+# script's name. Invoked by absolute path from another repo's checkout, the relative form
+# packed and published 25 unrelated packages (LocalDb's copy of this script, fixed in
+# 0038d46; recovered with `dotnet nuget delete`, but only because the token happened to
+# carry delete rights). A publish script must be unambiguous about WHAT it publishes no
+# matter where it is run.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
 
-dotnet nuget push "./artifacts/*.nupkg" \
+dotnet pack ZB.MOM.WW.Secrets.slnx -c Release -o "$REPO_ROOT/artifacts"
+
+dotnet nuget push "$REPO_ROOT/artifacts/*.nupkg" \
   --source "$GITEA_NUGET_SOURCE" \
   --api-key "$GITEA_NUGET_KEY" \
   --skip-duplicate
diff --git a/ZB.MOM.WW.Theme/build/pack.sh b/ZB.MOM.WW.Theme/build/pack.sh
index c166ead..c89b19c 100755
--- a/ZB.MOM.WW.Theme/build/pack.sh
+++ b/ZB.MOM.WW.Theme/build/pack.sh
@@ -6,4 +6,10 @@
 
 set -euo pipefail
 
-dotnet pack -c Release -o ./artifacts
+# cd to the repo root and name the solution + an absolute output path: `dotnet pack` with
+# neither a project argument nor a fixed working directory packs whatever solution happens
+# to sit in the CALLER's directory (the bug behind the LocalDb feed incident, 0038d46).
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+dotnet pack ZB.MOM.WW.Theme.slnx -c Release -o "$REPO_ROOT/artifacts"
diff --git a/ZB.MOM.WW.Theme/build/push.sh b/ZB.MOM.WW.Theme/build/push.sh
index cd1ce5d..3a70c51 100755
--- a/ZB.MOM.WW.Theme/build/push.sh
+++ b/ZB.MOM.WW.Theme/build/push.sh
@@ -16,9 +16,20 @@ set -euo pipefail
 : "${GITEA_NUGET_SOURCE:?set GITEA_NUGET_SOURCE to your Gitea NuGet feed URL}"
 : "${GITEA_NUGET_KEY:?set GITEA_NUGET_KEY to your Gitea access token}"
 
-dotnet pack -c Release -o ./artifacts
+# Named solution, named output, and a cd to the repo root, all for one reason: `dotnet pack`
+# with neither a project argument nor a fixed working directory packs whatever solution
+# happens to sit in the CALLER's directory — and then pushes it to a live feed under this
+# script's name. Invoked by absolute path from another repo's checkout, the relative form
+# packed and published 25 unrelated packages (LocalDb's copy of this script, fixed in
+# 0038d46; recovered with `dotnet nuget delete`, but only because the token happened to
+# carry delete rights). A publish script must be unambiguous about WHAT it publishes no
+# matter where it is run.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
 
-dotnet nuget push "./artifacts/*.nupkg" \
+dotnet pack ZB.MOM.WW.Theme.slnx -c Release -o "$REPO_ROOT/artifacts"
+
+dotnet nuget push "$REPO_ROOT/artifacts/*.nupkg" \
   --source "$GITEA_NUGET_SOURCE" \
   --api-key "$GITEA_NUGET_KEY" \
   --skip-duplicate