diff --git a/roboco/llm/providers/grok_cli_config.py b/roboco/llm/providers/grok_cli_config.py
index bf1181cb..8213d364 100644
--- a/roboco/llm/providers/grok_cli_config.py
+++ b/roboco/llm/providers/grok_cli_config.py
@@ -30,6 +30,7 @@ from __future__ import annotations
 
 import json
 import os
+import tempfile
 from pathlib import Path
 from typing import Any
 
@@ -64,7 +65,12 @@ BASH_GUARD_HOOK = os.environ.get(
     "ROBOCO_BASH_GUARD_HOOK", "/app/scripts/bash-guard-hook.sh"
 )
 # The entrypoint reads the computed flags (one token per line) from this file.
-GROK_ARGS_PATH = Path(os.environ.get("ROBOCO_GROK_ARGS_FILE", "/tmp/roboco-grok-args"))
+# Defaults under the system temp dir (not a hardcoded /tmp literal) — the
+# entrypoint reads the same ROBOCO_GROK_ARGS_FILE / tmp default.
+GROK_ARGS_PATH = Path(
+    os.environ.get("ROBOCO_GROK_ARGS_FILE")
+    or Path(tempfile.gettempdir()) / "roboco-grok-args"
+)
 
 # Hard ceiling on agentic turns (loop guard). Operator-tunable.
 _DEFAULT_MAX_TURNS = 200
diff --git a/roboco/llm/providers/grok_cli_usage.py b/roboco/llm/providers/grok_cli_usage.py
index f74d62cb..0d524f10 100644
--- a/roboco/llm/providers/grok_cli_usage.py
+++ b/roboco/llm/providers/grok_cli_usage.py
@@ -28,6 +28,7 @@ from __future__ import annotations
 import contextlib
 import json
 import os
+import tempfile
 from pathlib import Path
 from typing import Any
 from urllib.parse import quote
@@ -35,8 +36,10 @@ from urllib.parse import quote
 from roboco.billing.pricing import calculate_cost
 
 # Where the entrypoint writes the captured usage for the orchestrator to read.
+# Defaults under the system temp dir (not a hardcoded /tmp literal).
 USAGE_OUT_PATH = Path(
-    os.environ.get("ROBOCO_GROK_USAGE_FILE", "/tmp/roboco-grok-usage.json")
+    os.environ.get("ROBOCO_GROK_USAGE_FILE")
+    or Path(tempfile.gettempdir()) / "roboco-grok-usage.json"
 )