diff --git a/roles/pi_musicmouse/handlers/main.yml b/roles/pi_musicmouse/handlers/main.yml
index 1ffa7ab..082dbce 100644
--- a/roles/pi_musicmouse/handlers/main.yml
+++ b/roles/pi_musicmouse/handlers/main.yml
@@ -11,6 +11,8 @@
     chdir: "{{ pi_musicmouse_build_cache }}/{{ musicmouse_version | regex_replace('/', '_') }}/web"
   delegate_to: localhost
   become: false
+  vars:
+    ansible_become: false  # see the first delegated task in tasks/main.yml
   changed_when: true
   notify: Compile frontend
 
@@ -20,6 +22,8 @@
     chdir: "{{ pi_musicmouse_build_cache }}/{{ musicmouse_version | regex_replace('/', '_') }}/web"
   delegate_to: localhost
   become: false
+  vars:
+    ansible_become: false  # see the first delegated task in tasks/main.yml
   changed_when: true
   notify: Sync frontend
 
diff --git a/roles/pi_musicmouse/tasks/main.yml b/roles/pi_musicmouse/tasks/main.yml
index f9c4cc1..da65430 100644
--- a/roles/pi_musicmouse/tasks/main.yml
+++ b/roles/pi_musicmouse/tasks/main.yml
@@ -119,6 +119,14 @@
     mode: "0755"
   delegate_to: localhost
   become: false
+  vars:
+    # `become: false` above is not enough on its own. pi_standard_setup's defaults set
+    # `ansible_become: true`, role defaults are play-wide host variables, and the
+    # `ansible_become` *variable* outranks the `become` *keyword* in Ansible's
+    # precedence - so every task here tried to sudo on the control machine. Those
+    # defaults are needed to bootstrap a fresh Pi (connect as `pi`, become root, enable
+    # root login), so override the variable here rather than removing them.
+    ansible_become: false
 
 - name: Checkout Musicmouse repo for frontend build (control machine)
   ansible.builtin.git:
@@ -129,6 +137,8 @@
     force: true
   delegate_to: localhost
   become: false
+  vars:
+    ansible_become: false  # see the first delegated task in tasks/main.yml
   notify: Build frontend
 
 - name: Samba setup