diff --git a/Cargo.lock b/Cargo.lock
index 0be57a9..d411715 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1229,6 +1229,12 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
 [[package]]
 name = "futures"
 version = "0.3.30"
@@ -2490,6 +2496,19 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "rand"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
+dependencies = [
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.3.1",
+ "rdrand",
+ "winapi",
+]
+
 [[package]]
 name = "rand"
 version = "0.7.3"
@@ -2534,6 +2553,21 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
 [[package]]
 name = "rand_core"
 version = "0.5.1"
@@ -2561,6 +2595,15 @@ dependencies = [
  "rand_core 0.5.1",
 ]
 
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.2.16"
@@ -2634,6 +2677,15 @@ version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5ea92a5b6195c6ef2a0295ea818b312502c6fc94dde986c5553242e18fd4ce2"
 
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "reqwest"
 version = "0.12.2"
@@ -3397,6 +3449,16 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "tempdir"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15f2b5fb00ccdf689e0149d1b1b3c03fead81c2b37735d812fa8bddbbf41b6d8"
+dependencies = [
+ "rand 0.4.6",
+ "remove_dir_all",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.10.1"
@@ -3492,7 +3554,6 @@ dependencies = [
  "pin-project",
  "portpicker",
  "prometheus",
- "rand 0.8.5",
  "reqwest",
  "routefinder",
  "semver 1.0.22",
@@ -3506,6 +3567,7 @@ dependencies = [
  "strum",
  "strum_macros",
  "tagged-base64",
+ "tempdir",
  "tide",
  "tide-websockets",
  "toml",
diff --git a/Cargo.toml b/Cargo.toml
index 5bd2c6f..bd99258 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -66,7 +66,7 @@ tracing-log = "0.2"
 tracing-subscriber = { version = "0.3.18", features = ["env-filter", "json"] }
 url = "2.5.0"
 vbs = "0.1"
-rand = "0.8"
+tempdir = "0.3"
 
 # Dependencies enabled by feature `testing`
 async-compatibility-layer = { version = "1.1", features = ["logging-utils"], optional = true }
diff --git a/src/app.rs b/src/app.rs
index 1d0c764..db964fc 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -22,7 +22,6 @@ use futures::future::{BoxFuture, FutureExt};
 use include_dir::{include_dir, Dir};
 use lazy_static::lazy_static;
 use maud::{html, PreEscaped};
-use rand::Rng;
 use semver::Version;
 use serde::{Deserialize, Serialize};
 use serde_with::{serde_as, DisplayFromStr};
@@ -36,6 +35,7 @@ use std::{
     ops::{Deref, DerefMut},
     path::PathBuf,
 };
+use tempdir::TempDir;
 use tide::{
     http::headers::HeaderValue,
     security::{CorsMiddleware, Origin},
@@ -270,14 +270,13 @@ impl<State: Send + Sync + 'static, Error: 'static> App<State, Error> {
 static DEFAULT_PUBLIC_DIR: Dir<'_> = include_dir!("$CARGO_MANIFEST_DIR/public/media");
 lazy_static! {
     static ref DEFAULT_PUBLIC_PATH: PathBuf = {
-        // Generate a random number to index into `/tmp` with
-        let mut rng = rand::thread_rng();
-        let index: u64 = rng.gen();
+        // Create a randomly generated temporary directory to extract the public directory into
+        let temp_dir = TempDir::new("tide-disco").expect("failed to create temporary directory");
 
         // The contents of the default public directory are included in the binary. The first time
         // the default directory is used, if ever, we extract them to a directory on the host file
         // system and return the path to that directory.
-        let path = PathBuf::from(format!("/tmp/tide-disco/{}/public/media", index));
+        let path = temp_dir.path().to_path_buf();
         // If the path already exists, move it aside so we can update it.
         let _ = fs::rename(&path, path.with_extension("old"));
         DEFAULT_PUBLIC_DIR.extract(&path).unwrap();