diff --git a/scripts/src/pac-feature-config-schema-stage.test.ts b/scripts/src/pac-feature-config-schema-stage.test.ts
index c00aac35..5da4e6ba 100644
--- a/scripts/src/pac-feature-config-schema-stage.test.ts
+++ b/scripts/src/pac-feature-config-schema-stage.test.ts
@@ -1,5 +1,5 @@
 import { expect, test } from "bun:test";
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
@@ -35,8 +35,10 @@ test("HWLAB, AgentRun, and Sentinel normal stages validate without source worksp
   try {
     const source = join(root, "source");
     const rendered = join(root, "rendered");
+    const temp = join(root, "tmp");
     mkdirSync(join(source, "config"), { recursive: true });
     mkdirSync(rendered, { recursive: true });
+    mkdirSync(temp);
     writeFileSync(join(source, "config", "feature-config.schema.json"), JSON.stringify({
       $schema: "https://json-schema.org/draft/2020-12/schema",
       type: "object",
@@ -59,10 +61,16 @@ test("HWLAB, AgentRun, and Sentinel normal stages validate without source worksp
         repoDirExpression: JSON.stringify(source),
         renderedRootExpression: JSON.stringify(rendered),
       });
-      const result = spawnSync("sh", [], { input: `set -eu\n${stage}\n`, encoding: "utf8" });
+      const result = spawnSync("sh", [], {
+        input: `set -eu\n${stage}\n`,
+        encoding: "utf8",
+        env: { ...process.env, TMPDIR: temp },
+      });
       expect(result.status, consumer.consumer).toBe(0);
       expect(result.stderr, consumer.consumer).toContain('"code":"feature-config-schema-valid"');
       expect(result.stderr, consumer.consumer).not.toContain("feature-config-validator-unavailable");
+      expect(result.stderr, consumer.consumer).not.toContain("feature-config-validator-process-failure");
+      expect(readdirSync(temp), consumer.consumer).toEqual([]);
     }
   } finally {
     rmSync(root, { recursive: true, force: true });
@@ -73,7 +81,9 @@ test("embedded node process failure remains a typed warning with zero shell exit
   const root = mkdtempSync(join(tmpdir(), "feature-config-stage-"));
   try {
     const bin = join(root, "bin");
+    const temp = join(root, "tmp");
     mkdirSync(bin);
+    mkdirSync(temp);
     writeFileSync(join(bin, "node"), "#!/bin/sh\nexit 71\n", { mode: 0o755 });
     const stage = renderPacFeatureConfigSchemaStage({
       repositoryId: "sentinel-nc01-v03",
@@ -83,11 +93,12 @@ test("embedded node process failure remains a typed warning with zero shell exit
     });
     const result = spawnSync("sh", [], {
       input: `set -eu\n${stage}\n`,
-      env: { ...process.env, PATH: `${bin}:${process.env.PATH ?? ""}` },
+      env: { ...process.env, PATH: `${bin}:${process.env.PATH ?? ""}`, TMPDIR: temp },
       encoding: "utf8",
     });
     expect(result.status).toBe(0);
     expect(result.stderr).toContain("feature-config-validator-process-failure");
+    expect(readdirSync(temp)).toEqual([]);
   } finally {
     rmSync(root, { recursive: true, force: true });
   }
diff --git a/scripts/src/pac-feature-config-schema-stage.ts b/scripts/src/pac-feature-config-schema-stage.ts
index 517b00c0..4eb70a3d 100644
--- a/scripts/src/pac-feature-config-schema-stage.ts
+++ b/scripts/src/pac-feature-config-schema-stage.ts
@@ -49,10 +49,10 @@ export function renderPacFeatureConfigSchemaStage(options: PacFeatureConfigSchem
     "  consumer: process.env.UNIDESK_PAC_CONSUMER,",
     "});",
     "NODE_UNIDESK_FEATURE_CONFIG_SCHEMA",
-    ...(materializeBundle ? ["if [ -n \"$feature_config_ajv_bundle\" ]; then rm -f \"$feature_config_ajv_bundle\" || true; fi"] : []),
     "then",
     "  printf '{\"event\":\"feature-config-schema-validation\",\"warning\":true,\"blocking\":false,\"code\":\"feature-config-validator-process-failure\",\"mutation\":false,\"valuesPrinted\":false}\\n' >&2",
     "fi",
+    ...(materializeBundle ? ["if [ -n \"$feature_config_ajv_bundle\" ]; then rm -f \"$feature_config_ajv_bundle\" || true; fi"] : []),
     "if command -v ci_timing_emit >/dev/null 2>&1; then",
     "  ci_timing_emit feature-config-schema-validation succeeded \"$feature_config_schema_started_ms\"",
     "else",