diff --git a/platform/service/distribution_builder.go b/platform/service/distribution_builder.go
index 9744017..04d0448 100644
--- a/platform/service/distribution_builder.go
+++ b/platform/service/distribution_builder.go
@@ -483,7 +483,7 @@ if [ "$COMPONENT_KIND" = "run" ]; then
   progress 24 'git_sync: preparing run source snapshot'
   rm -rf /workspace/build/run-source
   mkdir -p /workspace/build/run-source
-  cp -R /workspace/source/. /workspace/build/run-source/
+  find /workspace/source -mindepth 1 -maxdepth 1 ! -name pax_global_header -exec cp -R {} /workspace/build/run-source/ \;
   progress 34 'env_check: injecting run build metadata'
   seed_b64="$(base64 /workspace/input/workspace-seed.json | tr -d '\n')"
   cat > /workspace/build/run-source/config/workspace_seed_generated.go <<EOF
diff --git a/platform/service/distribution_builder_test.go b/platform/service/distribution_builder_test.go
index 6aa380d..26ac77a 100644
--- a/platform/service/distribution_builder_test.go
+++ b/platform/service/distribution_builder_test.go
@@ -203,7 +203,7 @@ func TestDockerDistributionBuilderKeepsSecretInIsolatedInput(t *testing.T) {
 			if bytes.Contains(script, []byte(secret)) {
 				t.Fatal("build script must not embed the component auth key")
 			}
-			for _, ordered := range [][2]string{{"cp -R /workspace/source/. /workspace/build/run-source/", "workspace_seed_generated.go"}, {"workspace_seed_generated.go", "go build -trimpath -ldflags"}} {
+			for _, ordered := range [][2]string{{"find /workspace/source -mindepth 1 -maxdepth 1 ! -name pax_global_header", "workspace_seed_generated.go"}, {"workspace_seed_generated.go", "go build -trimpath -ldflags"}} {
 				if bytes.Index(script, []byte(ordered[0])) >= bytes.Index(script, []byte(ordered[1])) {
 					t.Fatalf("Run build script must prepare source before injecting config and compiling: %q before %q", ordered[0], ordered[1])
 				}