diff --git a/.github/workflows/build-and-deploy-ghcr.yml b/.github/workflows/build-and-deploy-ghcr.yml
index 54c8ec6..9ee15a8 100644
--- a/.github/workflows/build-and-deploy-ghcr.yml
+++ b/.github/workflows/build-and-deploy-ghcr.yml
@@ -54,8 +54,10 @@ jobs:
         run: |
           set -euo pipefail
           image_ref="${IMAGE_NAME}@${{ steps.build.outputs.digest }}"
-          git clone "https://${{ secrets.GHCR_USERNAME }}:${GITOPS_TOKEN}@github.com/${GITOPS_REPO}.git" /tmp/nxtgauge-gitops
-          cd /tmp/nxtgauge-gitops
+          workdir="$(mktemp -d /tmp/nxtgauge-gitops.XXXXXX)"
+          trap 'rm -rf "$workdir"' EXIT
+          git clone "https://${{ secrets.GHCR_USERNAME }}:${GITOPS_TOKEN}@github.com/${GITOPS_REPO}.git" "$workdir"
+          cd "$workdir"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           for attempt in 1 2 3 4 5; do