diff --git a/platform/service/distribution_builder.go b/platform/service/distribution_builder.go
index 3aa9d59..06d3032 100644
--- a/platform/service/distribution_builder.go
+++ b/platform/service/distribution_builder.go
@@ -486,6 +486,7 @@ if [ "$COMPONENT_KIND" = "run" ]; then
   find /workspace/source -mindepth 1 -maxdepth 1 ! -name pax_global_header -exec cp -R {} /workspace/build/run-source/ \;
   progress 34 'env_check: injecting run build metadata'
   seed_b64="$(base64 /workspace/input/workspace-seed.json | tr -d '\n')"
+  mkdir -p /workspace/build/run-source/config
   cat > /workspace/build/run-source/config/workspace_seed_generated.go <<EOF
 package config
 
diff --git a/platform/service/distribution_builder_test.go b/platform/service/distribution_builder_test.go
index 5bd44c9..0269f84 100644
--- a/platform/service/distribution_builder_test.go
+++ b/platform/service/distribution_builder_test.go
@@ -203,7 +203,7 @@ func TestDockerDistributionBuilderKeepsSecretInIsolatedInput(t *testing.T) {
 			if bytes.Contains(script, []byte(secret)) {
 				t.Fatal("build script must not embed the component auth key")
 			}
-			for _, ordered := range [][2]string{{"find /workspace/source -mindepth 1 -maxdepth 1 ! -name pax_global_header", "workspace_seed_generated.go"}, {"workspace_seed_generated.go", "go build -trimpath -ldflags"}} {
+			for _, ordered := range [][2]string{{"find /workspace/source -mindepth 1 -maxdepth 1 ! -name pax_global_header", "mkdir -p /workspace/build/run-source/config"}, {"mkdir -p /workspace/build/run-source/config", "workspace_seed_generated.go"}, {"workspace_seed_generated.go", "go build -trimpath -ldflags"}} {
 				if bytes.Index(script, []byte(ordered[0])) >= bytes.Index(script, []byte(ordered[1])) {
 					t.Fatalf("Run build script must prepare source before injecting config and compiling: %q before %q", ordered[0], ordered[1])
 				}