diff --git a/contrib/agrarian-build-menu.sh b/contrib/agrarian-build-menu.sh
index ccd43ea9..737fe0e6 100755
--- a/contrib/agrarian-build-menu.sh
+++ b/contrib/agrarian-build-menu.sh
@@ -10,6 +10,20 @@ HOST_WIN64="${HOST_WIN64:-x86_64-w64-mingw32}"
 MENU_CHOICE=""
 ROOT=""
 
+if [[ "${EUID:-$(id -u)}" -eq 0 && "${ALLOW_ROOT_BUILD_MENU:-0}" != "1" ]]; then
+  cat >&2 <<EOF
+Do not run this script with sudo.
+
+Run it as your normal local user:
+  ./contrib/agrarian-build-menu.sh
+
+The script will ask for sudo only when it needs to install Ubuntu packages or
+set the MinGW POSIX compiler alternatives. Repository checkout, compilation,
+daemon config, and user systemd service setup run as the local user.
+EOF
+  exit 1
+fi
+
 has_cmd() {
   command -v "$1" >/dev/null 2>&1
 }
diff --git a/doc/build-menu.md b/doc/build-menu.md
index c935bcee..d501f9c3 100644
--- a/doc/build-menu.md
+++ b/doc/build-menu.md
@@ -20,6 +20,10 @@ From an existing checkout:
 
     ./contrib/agrarian-build-menu.sh
 
+Do not run the script with `sudo`. It runs checkout, compilation, daemon config,
+and the user systemd service as the current local user. It asks for sudo only
+when it needs to install Ubuntu packages or set MinGW compiler alternatives.
+
 From a fresh Ubuntu host:
 
     sudo apt-get update