diff --git a/.gitea/workflows/release-chart.yaml b/.gitea/workflows/release-chart.yaml
index 7c018a3..516f3a9 100644
--- a/.gitea/workflows/release-chart.yaml
+++ b/.gitea/workflows/release-chart.yaml
@@ -25,6 +25,10 @@ name: Release chart
 # generic OCI artifacts, and a chart sharing the exact repository path with
 # the container image of the same name makes the package listing/type
 # ambiguous. A distinct `charts/` path keeps the two package kinds apart.
+#
+# Also pushes charts/aptly/artifacthub-repo.yml as a companion OCI artifact
+# (tag `artifacthub.io`) on every run, proving ownership of this repository
+# to ArtifactHub — see the "Publish ArtifactHub repository metadata" step.
 on:
   release:
     types: [published]
@@ -104,6 +108,22 @@ jobs:
             --username "${{ secrets.REGISTRY_USER }}" --password-stdin
           helm push "aptly-${{ steps.version.outputs.version }}.tgz" oci://git.morlana.online/f.weber/charts
 
+      # Publishes charts/aptly/artifacthub-repo.yml as its own OCI artifact
+      # (tag `artifacthub.io`) next to the chart — this is how ArtifactHub
+      # verifies ownership of an OCI-based Helm repository; there's no
+      # index.yaml it could otherwise crawl a metadata file out of. Uses the
+      # same registry credentials as the chart push above, nothing
+      # ArtifactHub-specific is needed (ArtifactHub has no publish API to
+      # authenticate against — it only reads the registry).
+      - uses: oras-project/setup-oras@v1
+      - name: Publish ArtifactHub repository metadata (ownership verification)
+        run: |
+          echo "${{ secrets.REGISTRY_TOKEN }}" | oras login git.morlana.online \
+            --username "${{ secrets.REGISTRY_USER }}" --password-stdin
+          oras push git.morlana.online/f.weber/charts/aptly:artifacthub.io \
+            --config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \
+            charts/aptly/artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml
+
       - name: Attach chart artifacts to the Gitea release
         uses: softprops/action-gh-release@v2
         with:
diff --git a/charts/aptly/Chart.yaml b/charts/aptly/Chart.yaml
index 337d145..ea8d9c6 100644
--- a/charts/aptly/Chart.yaml
+++ b/charts/aptly/Chart.yaml
@@ -5,7 +5,7 @@ description: >-
   an nginx read/auth sidecar, a fully aptly-native values API, and declarative
   repo/mirror/publish state reconciled via a Helm hook.
 type: application
-version: 0.2.1
+version: 0.2.2
 appVersion: "1.6.3-1"
 home: https://git.morlana.online/f.weber/aptly-containerized
 sources:
@@ -32,5 +32,7 @@ annotations:
     fingerprint: FC35C0FAA26605C4C21C7BBFBF43884145E5AA94
     url: https://git.morlana.online/f.weber/aptly-containerized/raw/branch/main/pubkeys/chart-signing.asc
   artifacthub.io/changes: |
+    - kind: added
+      description: Repository ownership verification for ArtifactHub (charts/aptly/artifacthub-repo.yml), published as a companion OCI artifact by release-chart.yaml.
     - kind: fixed
-      description: The aptly container's startup/readiness/liveness probes now exec curl against 127.0.0.1 instead of using httpGet. httpGet probes are dialed by kubelet against the pod IP, not localhost — since aptly listens on 127.0.0.1 only (by design, see proxy.enabled), that connection was always refused, leaving the pod stuck failing its startup probe forever despite aptly actually being healthy.
+      description: The reconcile Job's container had readOnlyRootFilesystem but no writable /tmp, so its own API client's scratch files failed to write ("Read-only file system") and every reconcile call died with a misleading "connection" error. A /tmp emptyDir is now mounted there too, matching the aptly/nginx containers in the StatefulSet.
diff --git a/charts/aptly/artifacthub-repo.yml b/charts/aptly/artifacthub-repo.yml
new file mode 100644
index 0000000..ede1469
--- /dev/null
+++ b/charts/aptly/artifacthub-repo.yml
@@ -0,0 +1,6 @@
+repositoryID: "1ed468a7-7886-48ad-8835-369bc8a06bc5"
+owners:
+  - name: Morlana
+    email: contact@morlana.net
+  - name: Florian Weber
+    email: f.weber@flweber.me
diff --git a/charts/aptly/templates/job-reconcile.yaml b/charts/aptly/templates/job-reconcile.yaml
index 28ccd99..b9ecb77 100644
--- a/charts/aptly/templates/job-reconcile.yaml
+++ b/charts/aptly/templates/job-reconcile.yaml
@@ -75,10 +75,14 @@ spec:
               mountPath: /state.yaml
               subPath: state.yaml
               readOnly: true
+            - name: tmp
+              mountPath: /tmp
           resources:
             {{- toYaml .Values.reconcile.resources | nindent 12 }}
       volumes:
         - name: state
           configMap:
             name: {{ $fullname }}-state
+        - name: tmp
+          emptyDir: {}
 {{- end }}