diff --git a/cmd/server/build_scripts_test.go b/cmd/server/build_scripts_test.go
new file mode 100644
index 00000000..a2c45721
--- /dev/null
+++ b/cmd/server/build_scripts_test.go
@@ -0,0 +1,47 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// Every `go build` in this repository's scripts has to target the cmd/server package.
+// Building the single file cmd/server/main.go was tried once and broke the password reset
+// entry: the file-based form silently leaves out sibling files of package main (it was
+// update_cli.go that disappeared), and only `run.sh --reset-admin-password` used that
+// build path, so nothing noticed until an operator needed it in an emergency. Compiling
+// the package can never have that failure mode.
+func TestScriptsBuildThePackageNotASingleFile(t *testing.T) {
+	root := filepath.Join("..", "..")
+	scripts := []string{filepath.Join(root, "run.sh"), filepath.Join(root, "upgrade.sh")}
+	more, err := filepath.Glob(filepath.Join(root, "scripts", "*.sh"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	scripts = append(scripts, more...)
+
+	found := 0
+	for _, script := range scripts {
+		data, err := os.ReadFile(script)
+		if err != nil {
+			t.Fatalf("read %s: %v", script, err)
+		}
+		for _, line := range strings.Split(string(data), "\n") {
+			if !strings.Contains(line, "go build") {
+				continue
+			}
+			found++
+			if strings.Contains(line, ".go") {
+				t.Errorf("%s builds a single .go file; build ./cmd/server instead:\n  %s",
+					script, strings.TrimSpace(line))
+			}
+		}
+	}
+	// A scan that finds no build command at all is looking in the wrong place, and a test
+	// that cannot see the thing it guards passes for the wrong reason.
+	if found == 0 {
+		t.Fatal("no `go build` command found in the scripts")
+	}
+}
diff --git a/run.sh b/run.sh
index c58b6186..3f6e382a 100755
--- a/run.sh
+++ b/run.sh
@@ -374,7 +374,7 @@ build_go_project_quiet() {
     rm -f "$GO_DOWNLOAD_LOG"
 
     GO_BUILD_LOG=$(mktemp)
-    if ! GOPROXY="$GOPROXY" go build -o "$BINARY_NAME" cmd/server/main.go >"$GO_BUILD_LOG" 2>&1; then
+    if ! GOPROXY="$GOPROXY" go build -o "$BINARY_NAME" ./cmd/server >"$GO_BUILD_LOG" 2>&1; then
         error "Build failed"
         echo ""
         info "Build error details:"