diff --git a/operator_setup.sh b/operator_setup.sh
index 6548ef9..5649d22 100755
--- a/operator_setup.sh
+++ b/operator_setup.sh
@@ -355,11 +355,12 @@ elif [[ "$vpn_opt" == "4" ]]; then
     prompt_default AUTOSSH_REMOTE_PORT "Remote tunnel port (device SSH appears here on server)" "$DEFAULT_REMOTE_PORT"
 
     # Generate dedicated tunnel keypair — keeps it separate from device management key
-    _TMP_TKEY=$(mktemp)
+    _TMP_TDIR=$(mktemp -d)
+    _TMP_TKEY="${_TMP_TDIR}/id_ed25519"
     ssh-keygen -t ed25519 -N "" -C "bb-tunnel-${DEVICE_ID}" -f "$_TMP_TKEY" -q
     AUTOSSH_PRIVKEY=$(cat "$_TMP_TKEY")
     AUTOSSH_PUBKEY=$(cat "${_TMP_TKEY}.pub")
-    rm -f "$_TMP_TKEY" "${_TMP_TKEY}.pub"
+    rm -rf "$_TMP_TDIR"
 
     echo ""
     echo -e "  ${YELLOW}Add this public key to ${AUTOSSH_USER}@${AUTOSSH_SERVER}:~/.ssh/authorized_keys before powering on:${NC}"