diff --git a/roles/koji_hub/files/updatecrl.sh b/roles/koji_hub/files/updatecrl.sh
index 8c14aff9c1..e40684a9d0 100644
--- a/roles/koji_hub/files/updatecrl.sh
+++ b/roles/koji_hub/files/updatecrl.sh
@@ -2,7 +2,7 @@
 
 URL=https://admin.fedoraproject.org/ca/crl.pem
 OLD=/etc/pki/tls/crl.pem
-NEW=/var/tmp/crl.pem
+NEW=`mktemp`
 
 wget $URL -O $NEW
 OLDUPDATE=`openssl crl -in $OLD -noout -lastupdate`
@@ -15,3 +15,4 @@ if [ "$OLDUPDATE" != "$NEWUPDATE" ]; then
     echo "updated to $NEWUPDATE"
 fi
 
+rm -f $NEW