diff --git a/contrib/testing/smtp-dane-mta-sts-check.py b/contrib/testing/smtp-dane-mta-sts-check.py
index 1c7d880..b116678 100755
--- a/contrib/testing/smtp-dane-mta-sts-check.py
+++ b/contrib/testing/smtp-dane-mta-sts-check.py
@@ -43,7 +43,6 @@ ANCHOR_FILE = Path("/etc/dnssec/root-anchors.txt")
 ANCHOR_BACKUP = Path("/run/bongo-smtp27-root-anchors.backup")
 PKI_ROOT = Path("/var/lib/bongo-test-pki")
 PKI_TOOL = Path(__file__).with_name("local-test-pki.py")
-WORK_ROOT = Path("/var/lib/bongo/work")
 
 
 class SMTP27Error(RuntimeError):
@@ -684,8 +683,10 @@ def perform_test() -> None:
         valid_tlsa = certificate_sha256(untrusted / "cert.pem")
 
         bongo_user = pwd.getpwnam("bongo")
-        dns_directory = Path(tempfile.mkdtemp(
-            prefix="smtp27-", dir=WORK_ROOT))
+        # named drops privileges to its service account.  Keep this isolated
+        # fixture outside Bongo's deliberately private runtime tree instead of
+        # weakening /var/lib/bongo/work permissions for the test.
+        dns_directory = Path(tempfile.mkdtemp(prefix="bongo-smtp27-"))
         dns_directory.chmod(0o755)
         cache_directory = dns_directory / "mta-sts-cache"
         cache_directory.mkdir(mode=0o750)