diff --git a/packaging/linux/nfpm.yaml b/packaging/linux/nfpm.yaml
index 2ce838a950..0767018430 100644
--- a/packaging/linux/nfpm.yaml
+++ b/packaging/linux/nfpm.yaml
@@ -1,5 +1,6 @@
 # .deb and .rpm packages (nfpm: https://nfpm.goreleaser.com). Run by package.sh, which stages
-# the file tree in $STAGE and exports VERSION, NFPM_ARCH and STAGE.
+# the file tree, substitutes its path for ${STAGE} (nfpm doesn't expand env vars in `src`) and
+# exports VERSION and NFPM_ARCH.
 #
 #   nfpm package -f packaging/linux/nfpm.yaml -p deb -t dist/release/
 name: photocraft
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index 4b1dfe823b..b295cc452f 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -81,10 +81,12 @@ fi
 # ---- .deb / .rpm --------------------------------------------------------------------------------
 if has deb || has rpm; then
   command -v nfpm >/dev/null || { echo "error: nfpm not found (https://nfpm.goreleaser.com/install/)" >&2; exit 1; }
-  export STAGE VERSION
+  export VERSION
   export NFPM_ARCH="$DEB_ARCH"
+  # nfpm expands env vars in fields like `version` and `arch`, but not in `contents[].src`.
+  sed "s|\${STAGE}|$STAGE|g" "$HERE/nfpm.yaml" >"$WORK/nfpm.yaml"
   for fmt in deb rpm; do
-    if has "$fmt"; then (cd "$ROOT" && nfpm package -f "$HERE/nfpm.yaml" -p "$fmt" -t "$DIST/$BASENAME.$fmt"); fi
+    if has "$fmt"; then (cd "$ROOT" && nfpm package -f "$WORK/nfpm.yaml" -p "$fmt" -t "$DIST/$BASENAME.$fmt"); fi
   done
 fi