diff --git a/src/deb/local.rs b/src/deb/local.rs
index 19c369b..7c0b116 100644
--- a/src/deb/local.rs
+++ b/src/deb/local.rs
@@ -107,12 +107,15 @@ fn ensure_build_user(
     workroot: &Path,
     ccache_dir: Option<&str>,
 ) -> Result<(String, String), Box<dyn Error>> {
-    let probe = ctx
-        .command("id")
-        .arg("-u")
-        .arg(BUILD_USER)
-        .output()
-        .map_err(|e| format!("cannot look up {BUILD_USER}: {e}"))?;
+    // Through sh with the stderr dropped: a missing user is the expected
+    // state in a fresh chroot, not a message the build log needs.
+    let id_of = |ctx: &Arc<Context>, what: &str| {
+        ctx.command("sh")
+            .arg("-c")
+            .arg(format!("id {what} {BUILD_USER} 2>/dev/null"))
+            .output()
+    };
+    let probe = id_of(ctx, "-u").map_err(|e| format!("cannot look up {BUILD_USER}: {e}"))?;
     let fresh = !probe.status.success();
     if fresh {
         create_build_user(ctx)?;
@@ -120,12 +123,7 @@ fn ensure_build_user(
 
     let mut ids = (String::new(), String::new());
     for (flag, slot) in [("-u", 0), ("-g", 1)] {
-        let output = ctx
-            .command("id")
-            .arg(flag)
-            .arg(BUILD_USER)
-            .output()
-            .map_err(|e| format!("cannot look up {BUILD_USER}: {e}"))?;
+        let output = id_of(ctx, flag).map_err(|e| format!("cannot look up {BUILD_USER}: {e}"))?;
         if !output.status.success() {
             return Err(format!("cannot resolve the ids of '{BUILD_USER}'").into());
         }