diff --git a/nodejs-csso/.SRCINFO b/nodejs-csso/.SRCINFO
index eb877bf..5b3173a 100644
--- a/nodejs-csso/.SRCINFO
+++ b/nodejs-csso/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = nodejs-csso
 	pkgdesc = CSS minifier with structural optimisations
 	pkgver = 4.2.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://github.com/css/csso
 	arch = any
 	license = MIT
diff --git a/nodejs-csso/PKGBUILD b/nodejs-csso/PKGBUILD
index 23ff843..dff6231 100644
--- a/nodejs-csso/PKGBUILD
+++ b/nodejs-csso/PKGBUILD
@@ -2,7 +2,7 @@
 
 pkgname=nodejs-csso
 pkgver=4.2.0
-pkgrel=1
+pkgrel=2
 pkgdesc="CSS minifier with structural optimisations"
 arch=('any')
 url="https://github.com/css/csso"
@@ -13,7 +13,13 @@ source=("https://registry.npmjs.org/csso/-/csso-$pkgver.tgz")
 sha256sums=('4b9b8c96cb4082224fec97d9050c48b1877bd03fab6332b2cb4b649b0f71f948')
 
 package() {
-    npm install -g --user root --prefix "$pkgdir"/usr "$srcdir"/csso-$pkgver.tgz
-    chmod -R go-w "$pkgdir"/usr
-    chown -R root:root "$pkgdir"/usr
+    npm install -g --prefix "$pkgdir"/usr "$srcdir"/csso-$pkgver.tgz
+
+    # Non-deterministic race in npm gives 777 permissions to random directories.
+    # See https://github.com/npm/npm/issues/9359 for details.
+    chmod -R u=rwX,go=rX "$pkgdir"
+
+    # npm installs package.json owned by build user
+    # https://bugs.archlinux.org/task/63396
+    chown -R root:root "$pkgdir"
 }