diff --git a/.forgejo/workflows/publish.yaml b/.forgejo/workflows/publish.yaml
index 82de69a..121df44 100644
--- a/.forgejo/workflows/publish.yaml
+++ b/.forgejo/workflows/publish.yaml
@@ -31,14 +31,16 @@ jobs:
           fetch() {
             repo="$1"; tag="$2"; filename="$3"; digest="$4"
 
-            curl -sSLO -w '%{stderr}HTTP %{response_code} %{url}\n' \
+            curl -sSLO --output-dir /tmp \
+                -w '%{stderr}HTTP %{response_code} %{url}\n' \
                 "https://github.com/$repo/releases/download/$tag/$filename"
 
-            printf '%s  %s\n' "$digest" "$filename" > digest
-            sha256sum --check digest && tar xf "$filename" -C tools
+            printf '%s  %s\n' "$digest" "/tmp/$filename" > /tmp/digest
+            sha256sum --check /tmp/digest
+            tar xf "/tmp/$filename" -C /tmp/tools
           }
 
-          mkdir tools
+          mkdir /tmp/tools
 
           fetch casey/just ${{ env.JUST_VERSION }} \
             just-${{ env.JUST_VERSION }}-x86_64-unknown-linux-musl.tar.gz \
@@ -47,7 +49,7 @@ jobs:
             cargo-llvm-cov-x86_64-unknown-linux-gnu.tar.gz \
             ${{ env.CARGO_LLVM_COV_SHA256SUM }}
 
-          mv -v tools/just tools/cargo-llvm-cov /usr/local/bin
+          mv -v /tmp/tools/just /tmp/tools/cargo-llvm-cov /usr/local/bin
 
       - name: Build release binary and upload it
         run: just upload