diff --git a/ci/version-info/default.nix b/ci/version-info/default.nix
index e11c0e4c..c746b1eb 100644
--- a/ci/version-info/default.nix
+++ b/ci/version-info/default.nix
@@ -20,24 +20,31 @@ writeShellApplication {
   };
 
   text = ''
-    # Download channel info from NixOS/infra
-    curl ${channelsURL} | nix eval --file - --json > channels.json
-
-    # Use channels.nix to build channels.toml
-    nix build --impure \
-      --file ${./supported-versions.nix} \
-      --argstr system ${stdenv.hostPlatform.system} \
-      --arg-from-file channelsJSON channels.json \
-      --out-link channels.toml
-
+    work=$(mktemp -d)
     (
+      cd "$work"
+
+      # Download channel info from NixOS/infra
+      curl ${channelsURL} | nix eval --file - --json > channels.json
+
+      # Use channels.nix to build channels.toml
+      nix build --impure \
+        --file ${./supported-versions.nix} \
+        --argstr system ${stdenv.hostPlatform.system} \
+        --arg-from-file channelsJSON channels.json \
+        --out-link channels.toml
+    )
+
+    {
       echo "# DO NOT MODIFY!"
       echo "# This file was generated by ${
         lib.strings.removePrefix (toString ../.. + "/") (toString ./default.nix)
       }"
       cat ${mainInfo}
       echo
-      cat channels.toml
-    ) > version-info.toml
+      cat "$work/channels.toml"
+    } > version-info.toml
+
+    rm -rf "$work"
   '';
 }