diff --git a/src/credentials/keychain.ts b/src/credentials/keychain.ts
index 22b88f16d..a2d029da5 100644
--- a/src/credentials/keychain.ts
+++ b/src/credentials/keychain.ts
@@ -1279,7 +1279,11 @@ const FILE_ENV_POINTERS: Array<[RegExp, (abs: string) => string]> = [
 
 export function renderUseScript(m: MaterializedCred): string {
   if (m.kind === "env") return m.env.map((e) => `export ${e.key}=${shq(e.value)}`).join("\n") + "\n";
-  const lines = [`__kc_dir="$(mktemp -d "\${TMPDIR:-/tmp}/keychain.XXXXXX")"`, `umask 077`];
+  const lines = [
+    `__kc_dir="$(mktemp -d "\${TMPDIR:-/tmp}/keychain.XXXXXX")"`,
+    `umask 077`,
+    `trap 'rm -rf "$__kc_dir"' EXIT`,
+  ];
   for (const f of m.files) {
     const parent = f.path.includes("/") ? f.path.replace(/\/[^/]*$/, "") : "";
     if (parent) lines.push(`mkdir -p "$__kc_dir/${parent}"`);
diff --git a/test/keychain.test.ts b/test/keychain.test.ts
index 0df8596e2..92442659b 100644
--- a/test/keychain.test.ts
+++ b/test/keychain.test.ts
@@ -514,6 +514,7 @@ test("file bundles: one item per service, materialize to a /tmp script with env
   assert.equal(m.kind, "file");
   const script = renderUseScript(m);
   assert.match(script, /mktemp -d/);
+  assert.match(script, /trap 'rm -rf "\$__kc_dir"' EXIT/);
   assert.match(script, /chmod 600/);
   assert.match(script, /export AWS_SHARED_CREDENTIALS_FILE="\$__kc_dir\/.aws\/credentials"/);
   assert.ok(