diff --git a/src/clients/QBittorrent.ts b/src/clients/QBittorrent.ts
index f7131df25..cdee6586f 100644
--- a/src/clients/QBittorrent.ts
+++ b/src/clients/QBittorrent.ts
@@ -2,9 +2,9 @@ import { fileFrom } from "fetch-blob/from.js";
 import { FormData } from "formdata-polyfill/esm.min.js";
 import { unlink, writeFile } from "fs/promises";
 import fetch, { BodyInit, Response } from "node-fetch";
-import { tmpdir } from "os";
 import { join, posix } from "path";
-import { InjectionResult } from "../constants.js";
+import { appDir } from "../configuration.js";
+import { InjectionResult, TORRENT_CACHE_FOLDER } from "../constants.js";
 import { CrossSeedError } from "../errors.js";
 import { Label, logger, logOnce } from "../logger.js";
 import { Metafile } from "../parseTorrent.js";
@@ -265,14 +265,14 @@ export default class QBittorrent implements TorrentClient {
 	): Promise<InjectionResult> {
 		const { duplicateCategories, skipRecheck, dataCategory } =
 			getRuntimeConfig();
+		const filename = `${newTorrent.getFileSystemSafeName()}.cross-seed.torrent`;
+		const tempFilepath = join(appDir(), TORRENT_CACHE_FOLDER, filename);
 		try {
 			if (await this.isInfoHashInClient(newTorrent.infoHash)) {
 				return InjectionResult.ALREADY_EXISTS;
 			}
 			const buf = newTorrent.encode();
-			const filename = `${newTorrent.getFileSystemSafeName()}.cross-seed.torrent`;
-			const tempFilepath = join(tmpdir(), filename);
-			await writeFile(tempFilepath, buf, { mode: 0o644 });
+			await writeFile(tempFilepath, buf, { mode: 0o600 });
 			const { save_path, isComplete, autoTMM, category } = path
 				? {
 						save_path: path,
@@ -336,10 +336,6 @@ export default class QBittorrent implements TorrentClient {
 				);
 			}
 
-			unlink(tempFilepath).catch((error) => {
-				logger.debug(error);
-			});
-
 			return InjectionResult.SUCCESS;
 		} catch (e) {
 			logger.debug({
@@ -347,6 +343,10 @@ export default class QBittorrent implements TorrentClient {
 				message: `injection failed: ${e.message}`,
 			});
 			return InjectionResult.FAILURE;
+		} finally {
+			await unlink(tempFilepath).catch((error) => {
+				logger.debug(error);
+			});
 		}
 	}
 }