diff --git a/builder/sigchecker.ml b/builder/sigchecker.ml
index 3c14aba88..e587b99b8 100644
--- a/builder/sigchecker.ml
+++ b/builder/sigchecker.ml
@@ -157,6 +157,7 @@ and do_verify t args =
   import_key t;
 
   let status_file = Filename.temp_file "vbstat" ".txt" in
+  unlink_on_exit status_file;
   let cmd =
     sprintf "%s --verify%s --status-file %s %s"
         t.gpg (if t.debug then "" else " -q --logger-file /dev/null")
@@ -170,7 +171,6 @@ and do_verify t args =
 
   (* Check the fingerprint is who it should be. *)
   let status = read_whole_file status_file in
-  unlink status_file;
 
   let status = string_nsplit "\n" status in
   let fingerprint = ref "" in
@@ -193,6 +193,7 @@ and import_key t =
   if not !key_imported && equal_fingerprints t.fingerprint default_fingerprint
   then (
     let filename, chan = Filename.open_temp_file "vbpubkey" ".asc" in
+    unlink_on_exit filename;
     output_string chan default_pubkey;
     close_out chan;
 
@@ -204,6 +205,5 @@ and import_key t =
       eprintf (f_"virt-builder: error: could not import public key\nUse the '-v' option and look for earlier error messages.\n");
       exit 1
     );
-    unlink filename;
     key_imported := true
   )