diff --git a/action.yml b/action.yml
index 1152a0d..94d77a2 100644
--- a/action.yml
+++ b/action.yml
@@ -41,7 +41,7 @@ runs:
         fi
     - name: Deploy
       shell: sh
-      run: ${{ github.action_path }}/entrypoint.sh
+      run: sh "${{ github.action_path }}/entrypoint.sh"
       env:
         INPUT_HOST: ${{ inputs.host }}
         INPUT_PORT: ${{ inputs.port }}
diff --git a/entrypoint.sh b/entrypoint.sh
old mode 100644
new mode 100755
index 449a656..5b9786b
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -24,20 +24,26 @@ fi
 SSH_PORT="${INPUT_PORT:-22}"
 SOURCE="${INPUT_SOURCE:-.}"
 
-mkdir -p ~/.ssh
-chmod 700 ~/.ssh
+# ssh expands ~ from the passwd database rather than $HOME, so the two disagree
+# whenever a container sets HOME elsewhere. Pass absolute paths instead.
+SSH_DIR="$HOME/.ssh"
+KEY_FILE="$SSH_DIR/deploy_key"
+KNOWN_HOSTS="$SSH_DIR/known_hosts"
 
-echo "$INPUT_KEY" > ~/.ssh/deploy_key
-chmod 600 ~/.ssh/deploy_key
+mkdir -p "$SSH_DIR"
+chmod 700 "$SSH_DIR"
 
-ssh-keyscan -p "$SSH_PORT" -H "$INPUT_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+trap 'rm -f "$KEY_FILE"' EXIT
+
+echo "$INPUT_KEY" > "$KEY_FILE"
+chmod 600 "$KEY_FILE"
+
+ssh-keyscan -p "$SSH_PORT" -H "$INPUT_HOST" >> "$KNOWN_HOSTS" 2>/dev/null
 
 rsync -avz \
-  -e "ssh -i ~/.ssh/deploy_key -p $SSH_PORT -o ConnectTimeout=30" \
+  -e "ssh -i $KEY_FILE -o UserKnownHostsFile=$KNOWN_HOSTS -p $SSH_PORT -o ConnectTimeout=30" \
   $INPUT_ARGS \
   "${SOURCE}/" \
   "${INPUT_USERNAME}@${INPUT_HOST}:${INPUT_TARGET}/"
 
-rm -f ~/.ssh/deploy_key
-
 echo "Deployed ${SOURCE} to ${INPUT_HOST}:${INPUT_TARGET}"