diff --git a/scripts/install-anywhere.nix b/scripts/install-anywhere.nix
index ca0b4f2..17e5c0b 100644
--- a/scripts/install-anywhere.nix
+++ b/scripts/install-anywhere.nix
@@ -1,4 +1,4 @@
-{ pkgs , ...}:
+{ pkgs, ... }:
 pkgs.writeShellApplication {
   name = "install-anywhere";
 
@@ -17,6 +17,7 @@ pkgs.writeShellApplication {
     host="$1"
     destination="$2"
     root="$(mktemp --directory)"
+    trap 'rm -rf "$root"' EXIT
 
     impermanence="$(nix eval ".#nixosConfigurations.$host.config.custom.persistence.enable")"
     if [ "$impermanence" = true ]; then
@@ -51,7 +52,5 @@ pkgs.writeShellApplication {
       --extra-files "$root" \
       --flake ".#$host" \
       --target-host "$destination"
-
-    rm -rf "$root"
   '';
 }
diff --git a/scripts/nebula-regen-all-host-certs.nix b/scripts/nebula-regen-all-host-certs.nix
index db09d6c..469d25b 100644
--- a/scripts/nebula-regen-all-host-certs.nix
+++ b/scripts/nebula-regen-all-host-certs.nix
@@ -1,4 +1,9 @@
-{ self', pkgs, lib, ... }:
+{
+  self',
+  pkgs,
+  lib,
+  ...
+}:
 pkgs.writeShellApplication {
   name = "nebula-regen-all-host-certs";