diff --git a/.github/workflows/build-and-deploy-ghcr.yml b/.github/workflows/build-and-deploy-ghcr.yml
index 1f89f73..59926c5 100644
--- a/.github/workflows/build-and-deploy-ghcr.yml
+++ b/.github/workflows/build-and-deploy-ghcr.yml
@@ -76,8 +76,10 @@ jobs:
           GITOPS_TOKEN: ${{ secrets.DEPLOY_GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          git clone "https://${{ secrets.GHCR_USERNAME }}:${GITOPS_TOKEN}@github.com/${GITOPS_REPO}.git" /tmp/nxtgauge-gitops
-          cd /tmp/nxtgauge-gitops
+          workdir="$(mktemp -d /tmp/nxtgauge-gitops.XXXXXX)"
+          trap 'rm -rf "$workdir"' EXIT
+          git clone "https://${{ secrets.GHCR_USERNAME }}:${GITOPS_TOKEN}@github.com/${GITOPS_REPO}.git" "$workdir"
+          cd "$workdir"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           for attempt in 1 2 3 4 5; do