diff --git a/package-lock.json b/package-lock.json
index 31dc47ca..6ae76cd7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6813,7 +6813,6 @@
       "version": "0.5.1",
       "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.1.tgz",
       "integrity": "sha1-MAV0OOrGz3+MR2fzhkjWaX11yQM=",
-      "dev": true,
       "requires": {
         "minimist": "0.0.8"
       },
@@ -6821,8 +6820,7 @@
         "minimist": {
           "version": "0.0.8",
           "resolved": "https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz",
-          "integrity": "sha1-hX/Kv8M5fSYluCKCYuhqp6ARsF0=",
-          "dev": true
+          "integrity": "sha1-hX/Kv8M5fSYluCKCYuhqp6ARsF0="
         }
       }
     },
diff --git a/package.json b/package.json
index 8b34185d..81c0ce9f 100644
--- a/package.json
+++ b/package.json
@@ -102,6 +102,7 @@
     "fluent": "^0.4.1",
     "fluent-langneg": "^0.1.0",
     "helmet": "^3.8.1",
+    "mkdirp": "^0.5.1",
     "mozlog": "^2.1.1",
     "raven": "^2.1.2",
     "redis": "^2.8.0"
diff --git a/server/config.js b/server/config.js
index 7e9ba621..e3e97b2a 100644
--- a/server/config.js
+++ b/server/config.js
@@ -1,4 +1,7 @@
 const convict = require('convict');
+const { tmpdir } = require('os');
+const path = require('path');
+const { randomBytes } = require('crypto');
 
 const conf = convict({
   s3_bucket: {
@@ -56,6 +59,11 @@ const conf = convict({
     format: 'url',
     default: 'https://send.firefox.com',
     env: 'BASE_URL'
+  },
+  file_dir: {
+    format: 'String',
+    default: `${tmpdir()}${path.sep}send-${randomBytes(4).toString('hex')}`,
+    env: 'FILE_DIR'
   }
 });
 
diff --git a/server/storage.js b/server/storage.js
index 7abd705d..e13a6f92 100644
--- a/server/storage.js
+++ b/server/storage.js
@@ -1,8 +1,8 @@
 const AWS = require('aws-sdk');
 const s3 = new AWS.S3();
+const mkdirp = require('mkdirp');
 
 const config = require('./config');
-const { tmpdir } = require('os');
 const fs = require('fs');
 const path = require('path');
 
@@ -25,7 +25,7 @@ redis_client.on('error', err => {
   log.error('Redis:', err);
 });
 
-let tempDir = null;
+const fileDir = config.file_dir;
 
 if (config.s3_bucket) {
   module.exports = {
@@ -44,8 +44,8 @@ if (config.s3_bucket) {
     metadata
   };
 } else {
-  tempDir = fs.mkdtempSync(`${tmpdir()}${path.sep}send-`);
-  log.info('tempDir', tempDir);
+  mkdirp.sync(config.file_dir);
+  log.info('fileDir', fileDir);
   module.exports = {
     filename: filename,
     exists: exists,
@@ -123,7 +123,7 @@ function setField(id, key, value) {
 function localLength(id) {
   return new Promise((resolve, reject) => {
     try {
-      resolve(fs.statSync(path.join(tempDir, id)).size);
+      resolve(fs.statSync(path.join(fileDir, id)).size);
     } catch (err) {
       reject();
     }
@@ -131,12 +131,12 @@ function localLength(id) {
 }
 
 function localGet(id) {
-  return fs.createReadStream(path.join(tempDir, id));
+  return fs.createReadStream(path.join(fileDir, id));
 }
 
 function localSet(newId, file, filename, meta) {
   return new Promise((resolve, reject) => {
-    const filepath = path.join(tempDir, newId);
+    const filepath = path.join(fileDir, newId);
     const fstream = fs.createWriteStream(filepath);
     file.pipe(fstream);
     file.on('limit', () => {
@@ -166,7 +166,7 @@ function localDelete(id, delete_token) {
       } else {
         redis_client.del(id);
         log.info('Deleted:', id);
-        resolve(fs.unlinkSync(path.join(tempDir, id)));
+        resolve(fs.unlinkSync(path.join(fileDir, id)));
       }
     });
   });
@@ -175,7 +175,7 @@ function localDelete(id, delete_token) {
 function localForceDelete(id) {
   return new Promise((resolve, reject) => {
     redis_client.del(id);
-    resolve(fs.unlinkSync(path.join(tempDir, id)));
+    resolve(fs.unlinkSync(path.join(fileDir, id)));
   });
 }