diff --git a/crates/media/tests/fixtures/make.sh b/crates/media/tests/fixtures/make.sh
index 083284a4..d85419b9 100755
--- a/crates/media/tests/fixtures/make.sh
+++ b/crates/media/tests/fixtures/make.sh
@@ -28,11 +28,13 @@ for f in range(6):
     sys.stdout.buffer.write(bytes(v for y in range(h) for x in range(w) for v in ((x * 4 + f * 20) % 256, (y * 5) % 256, (f * 40) % 256)))
 " > "$out"
 }
-frames 64 48 /tmp/deckcraft-fixture-64x48.rgb
-frames 64 64 /tmp/deckcraft-fixture-64x64.rgb
-VID="-f rawvideo -pix_fmt rgb24 -s 64x48 -r 10 -i /tmp/deckcraft-fixture-64x48.rgb"
+TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/deckcraft-fixture.XXXXXX")"
+trap 'rm -rf "$TMP_DIR"' EXIT
+frames 64 48 "$TMP_DIR/deckcraft-fixture-64x48.rgb"
+frames 64 64 "$TMP_DIR/deckcraft-fixture-64x64.rgb"
+VID="-f rawvideo -pix_fmt rgb24 -s 64x48 -r 10 -i $TMP_DIR/deckcraft-fixture-64x48.rgb"
 $FF $VID $TONE44 -c:v libx264 -pix_fmt yuv420p -g 5 -bf 2 -c:a aac -b:a 48k -shortest $META clip-h264.mp4
 $FF $VID -c:v libx264 -pix_fmt yuv420p -g 5 -bf 0 $META clip-h264.mov
 $FF $VID -c:v libx265 -pix_fmt yuv420p -x265-params log-level=error:keyint=5 -tag:v hvc1 $META clip-hevc.mp4
 $FF $VID $TONE -c:v libvpx-vp9 -pix_fmt yuv420p -g 5 -b:v 100k -c:a libopus -b:a 32k -shortest $META clip-vp9.webm
-$FF -f rawvideo -pix_fmt rgb24 -s 64x64 -r 10 -i /tmp/deckcraft-fixture-64x64.rgb -c:v libsvtav1 -pix_fmt yuv420p -g 5 -svtav1-params loglevel=0 $META clip-av1.mkv
+$FF -f rawvideo -pix_fmt rgb24 -s 64x64 -r 10 -i "$TMP_DIR/deckcraft-fixture-64x64.rgb" -c:v libsvtav1 -pix_fmt yuv420p -g 5 -svtav1-params loglevel=0 $META clip-av1.mkv
diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh
index 401cc301..901d3095 100755
--- a/packaging/macos/import-cert.sh
+++ b/packaging/macos/import-cert.sh
@@ -17,12 +17,14 @@ if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
   exit 0
 fi
 
-TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
-KEYCHAIN="$TMP/deckcraft-signing.keychain-db"
-CERT="$TMP/deckcraft-signing.p12"
+TMP_BASE="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
+TMP_DIR="$(mktemp -d "$TMP_BASE/deckcraft-cert.XXXXXX")"
+chmod 0700 "$TMP_DIR"
+KEYCHAIN="$TMP_DIR/deckcraft-signing.keychain-db"
+CERT="$TMP_DIR/deckcraft-signing.p12"
 KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
 
-trap 'rm -f "$CERT"' EXIT
+trap 'rm -rf "$TMP_DIR"' EXIT
 printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT"
 security create-keychain -p "$KC_PASS" "$KEYCHAIN"
 security set-keychain-settings -lut 21600 "$KEYCHAIN"