diff --git a/lib/impl/sandbox_helper.sh b/lib/impl/sandbox_helper.sh
index 4ea5ec5..294fc6b 100644
--- a/lib/impl/sandbox_helper.sh
+++ b/lib/impl/sandbox_helper.sh
@@ -35,6 +35,7 @@ done
 
 if [ "$NO_SANDBOX" = false ]; then
   echo "Running with simple sandboxing"
+  TMPDIR=$(mktemp -dt "nix-gitlab-ci.XXX")
   if [ "$KEEP_TMP" = false ]; then
     trap "rm -rf '$TMPDIR'" EXIT
   else
@@ -49,7 +50,6 @@ if [ "$NO_SANDBOX" = false ]; then
     git diff --staged > "$DIRTY_PATCH"
     trap "rm -f '$DIRTY_PATCH'" EXIT
   fi
-  TMPDIR=$(mktemp -dt "nix-gitlab-ci.XXX")
   git clone . $TMPDIR
   pushd $TMPDIR >/dev/null
   if [[ ! -z "$DIRTY_PATCH" && "$INCLUDE_DIRTY" = true ]]; then