diff --git a/modules/30-shell-zsh.sh b/modules/30-shell-zsh.sh
index 6790a6d..3528c52 100755
--- a/modules/30-shell-zsh.sh
+++ b/modules/30-shell-zsh.sh
@@ -6,9 +6,13 @@ step_desc="zsh + oh-my-zsh + plugins, set default shell, ship config"
 step_run="run_zsh"
 
 # All paths resolve against the config TARGET (set by 05-create-user).
-ZSH="${ZSH:-$TARGET_HOME/.oh-my-zsh}"
-ZSH_CUSTOM="${ZSH_CUSTOM:-$ZSH/custom}"
-ZDOTDIR_TARGET="${ZDOTDIR_TARGET:-$TARGET_HOME/.config/zsh}"
+# NOTE: we deliberately do NOT honor an inherited $ZSH env var — oh-my-zsh exports
+# ZSH when it loads, so a setup.sh run from an omz-equipped shell would otherwise
+# pin these to the *old* home (e.g. /root) while the chown step retargets to the
+# *new* user, mis-owning the wrong tree (the 'insecure completion dirs' bug).
+ZSH="$TARGET_HOME/.oh-my-zsh"
+ZSH_CUSTOM="$ZSH/custom"
+ZDOTDIR_TARGET="$TARGET_HOME/.config/zsh"
 
 run_zsh() {
   log "installing zsh + oh-my-zsh"