diff --git a/.cirrus.yml b/.cirrus.yml
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -75,14 +75,24 @@
   install_script:
   - sh .cirrus-ci/pkg-install.sh ${TOOLCHAIN_PKG} git-lite
 
+  # XXX Remove current and uncomment below once 2024Q1 has branched out
+  # upgrade_pkg_script:
+  # - pkg upgrade -y pkg
+  upgrade_pkg_script:
+  - fetch http://pkg.freebsd.org/FreeBSD:13:amd64/latest/All/pkg-1.20.9.pkg
+  - pkg install -y ./pkg-1.20.9.pkg
+  - rm -f pkg-1.20.9.pkg
+
   setup_script:
   - uname -a
   - gpart show
   - df -m
   - pkg --version
-  - pw useradd user
+  - pw useradd user -m
   - mkdir -p /usr/obj/$(pwd -P)
   - chown user:user /usr/obj/$(pwd -P)
+  - chown -R user:user $CIRRUS_WORKING_DIR
+  - su user -c "git config --global --add safe.directory $(pwd -P)"
 
   build_world_script:
   - su user -c "make -j$(sysctl -n hw.ncpu) ${EXTRA_MAKE_FLAGS} CROSS_TOOLCHAIN=${TOOLCHAIN} WITHOUT_TOOLCHAIN=yes buildworld"
@@ -102,19 +112,19 @@
 
   make_sysent_script:
   # Check that make sysent results were committed if required
-  - make sysent
-  - if ! git diff --exit-code; then printf "\n>>> Generated sysent files not updated, run make sysent <<<\n"; false; fi
+  - su user -c "make sysent"
+  - if ! su user -c "git diff --exit-code"; then printf "\n>>> Generated sysent files not updated, run make sysent <<<\n"; false; fi
 
   include_ldirs_script:
   # Check that includes/Makefile refers to existing directories
-  - if ! make -C include/ check-ldirs; then printf "\n>>> include/Makefile lists nonexistant directories <<<\n"; false; fi
+  - if ! su user -c "make -C include/ check-ldirs"; then printf "\n>>> include/Makefile lists nonexistant directories <<<\n"; false; fi
 
   makeman_script:
   # Check that the committed src.conf.5 matches the one generated by
   # tools/build/options/makeman (modulo the date which always updates)
   # XXX: This script is slow so keep it last
-  - (make makeman 2> /tmp/makeman.out); cat /tmp/makeman.out
-  - if ! git diff --exit-code --ignore-matching-lines "^.Dd" share/man/man5/src.conf.5; then printf "\n>>> src.conf.5 was not updated as required <<<\n"; false; fi
+  - (su user -c "make makeman" 2> /tmp/makeman.out); cat /tmp/makeman.out
+  - if ! su user -c 'git diff --exit-code --ignore-matching-lines "^.Dd" share/man/man5/src.conf.5'; then printf "\n>>> src.conf.5 was not updated as required <<<\n"; false; fi
   - if grep -q "no description found" /tmp/makeman.out; then printf "\n>>> Missing description files <<<\n"; false; fi
 
   post_script: