@@ -15,14 +15,16 @@ set -euo pipefail
 # Downloads into a private staging directory and promotes the artifacts to CWD
 # on success.  The staging directory is wiped before each retry so that
 # artifact directories left behind by a partial download do not cause gh to
-# refuse to re-download them on subsequent attempts.
+# refuse to re-download them on subsequent attempts.  Staging lives under
+# RUNNER_TEMP, which the runner empties at the start and end of every job, so
+# a killed or cancelled step cannot leak it.
 _retry_gh_run_download() {
     local max_attempts=5
     local delay=15
     local max_delay=120
     local attempt=1
     local staging
-    staging=$(mktemp -d)
+    staging=$(mktemp -d -p "${RUNNER_TEMP:-/tmp}")
 
     until gh run download "$@" -D "${staging}"; do
         rm -rf "${staging}"
@@ -34,7 +36,7 @@ _retry_gh_run_download() {
         sleep "${delay}"
         attempt=$(( attempt + 1 ))
         (( delay = delay * 2 > max_delay ? max_delay : delay * 2 ))
-        staging=$(mktemp -d)
+        staging=$(mktemp -d -p "${RUNNER_TEMP:-/tmp}")
     done
 
     # Promote each downloaded artifact directory into the caller's CWD.