diff --git a/action.yml b/action.yml
index 9e98fc5..f2741f7 100644
--- a/action.yml
+++ b/action.yml
@@ -101,13 +101,13 @@ runs:
         if [ "$PRIVATE_REPO" = 'true' ]; then 
           log "In a private repo, downloading $HEAD_BRANCH to build the old report"
 
-          mkdir -p old
+          old=$(mktemp -d)
           curl -X 'GET' \
             "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/archive/$HEAD_BRANCH.tar.gz" \
             -H "Authorization: token $GITHUB_TOKEN" |
-              tar -zvx --strip-components=1 -C old
+              tar -zvx --strip-components=1 -C "$old"
 
-          (cd old && "$GITHUB_ACTION_PATH/create-report.sh") > old-report.json
+          (cd "$old" && "$GITHUB_ACTION_PATH/create-report.sh") > old-report.json
 
           log "Reporting on sizes and comparing to sizes in $HEAD_BRANCH"
           "$GITHUB_ACTION_PATH/comment_on_pr.sh" report.json old-report.json