diff --git a/local/recipes/kde/plasma-desktop/recipe.toml b/local/recipes/kde/plasma-desktop/recipe.toml
index 413b7fba00..74268e3abc 100644
--- a/local/recipes/kde/plasma-desktop/recipe.toml
+++ b/local/recipes/kde/plasma-desktop/recipe.toml
@@ -94,7 +94,13 @@ cmake "${COOKBOOK_SOURCE}" \
     -DBUILD_TESTING=OFF \
     -Wno-dev
 cmake --build . -j"${COOKBOOK_MAKE_JOBS}"
-cmake --install . --prefix "${COOKBOOK_STAGE}/usr"
+# DESTDIR, not --prefix: `--prefix` re-roots only RELATIVE destinations, and
+# KDE's KDE_INSTALL_FULL_* paths are absolute, so cmake writes into the BUILD
+# HOST's filesystem instead. plasma-workspace hit exactly this:
+#   file INSTALL cannot copy ... to "/etc/xdg/plasmanotifyrc": Permission denied
+# Fixed here pre-emptively -- plasma-desktop ships /etc/xdg config too and has
+# never been built, so this would have cost a full build cycle to discover.
+DESTDIR="${COOKBOOK_STAGE}" cmake --install . --prefix /usr
 
 find "${COOKBOOK_STAGE}" -name '*.so*' -exec patchelf --remove-rpath {} \\; 2>/dev/null || true
 """
diff --git a/local/recipes/kde/plasma-workspace/recipe.toml b/local/recipes/kde/plasma-workspace/recipe.toml
index a2b92a5c4f..a47e8a1c2b 100644
--- a/local/recipes/kde/plasma-workspace/recipe.toml
+++ b/local/recipes/kde/plasma-workspace/recipe.toml
@@ -244,7 +244,15 @@ cmake "${COOKBOOK_SOURCE}" \
     -DWITH_X11_SESSION=OFF \
     -Wno-dev
 cmake --build . -j"${COOKBOOK_MAKE_JOBS}"
-cmake --install . --prefix "${COOKBOOK_STAGE}/usr"
+# DESTDIR, not --prefix. `--prefix` only re-roots RELATIVE install
+# destinations. KDE's KDE_INSTALL_FULL_* paths are ABSOLUTE, so cmake tried to
+# write into the BUILD HOST's filesystem:
+#   file INSTALL cannot copy file ".../libnotificationmanager/plasmanotifyrc"
+#   to "/etc/xdg/plasmanotifyrc": Permission denied.
+# Only the host's permissions stopped that from polluting the host /etc.
+# DESTDIR re-roots absolute destinations too. Same fix already applied to
+# kf6-ktexteditor, kde-cli-tools and sddm.
+DESTDIR="${COOKBOOK_STAGE}" cmake --install . --prefix /usr
 
 # KSMServerDBusInterface, installed OUTSIDE the X11 gate.
 #