diff --git a/plugins/00_dokku-standard/exec-app-json-scripts b/plugins/00_dokku-standard/exec-app-json-scripts
index 7ba6b6eca..7a2cf87af 100755
--- a/plugins/00_dokku-standard/exec-app-json-scripts
+++ b/plugins/00_dokku-standard/exec-app-json-scripts
@@ -5,11 +5,11 @@ source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
 get_phase_script() {
   declare desc="extracts app.json from app image and returns the appropriate json key/value"
   local IMAGE="$1"; local PHASE_SCRIPT_KEY="$2"
-  local TMP_WORK_DIR=$(mktemp -d -t "dokku_get_phase_script.XXXX")
-  local APP_JSON_FILE="$TMP_WORK_DIR/app.json"
-  trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' RETURN INT TERM
+  local GET_PHASE_SCRIPT_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku_get_phase_script.XXXX")
+  local APP_JSON_FILE="$GET_PHASE_SCRIPT_TMP_WORK_DIR/app.json"
+  trap 'rm -rf "$GET_PHASE_SCRIPT_TMP_WORK_DIR" > /dev/null' RETURN INT TERM
 
-  copy_from_image "$IMAGE" "/app/app.json" "$TMP_WORK_DIR" 2>/dev/null || true
+  copy_from_image "$IMAGE" "/app/app.json" "$GET_PHASE_SCRIPT_TMP_WORK_DIR" 2>/dev/null || true
 
   if [[ -f "$APP_JSON_FILE" ]];then
     local VALUE=$(get_json_value "scripts.dokku.${PHASE_SCRIPT_KEY}" < "$APP_JSON_FILE")
diff --git a/plugins/certs/subcommands/add b/plugins/certs/subcommands/add
index e31710ea6..2135ec253 100755
--- a/plugins/certs/subcommands/add
+++ b/plugins/certs/subcommands/add
@@ -38,9 +38,9 @@ certs_set() {
   is_file_import "$CRT_FILE" "$KEY_FILE" || is_tar_import || dokku_log_fail "Tar archive containing server.crt and server.key expected on stdin"
 
   if is_tar_import; then
-    local TEMP_DIR=$(mktemp -d -t "dokku_certs_set.XXXX")
-    pushd "$TEMP_DIR" &> /dev/null
-    trap 'popd &> /dev/null || true; rm -rf $TEMP_DIR > /dev/null' RETURN
+    local CERTS_SET_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku_certs_set.XXXX")
+    pushd "$CERTS_SET_TMP_WORK_DIR" &> /dev/null
+    trap 'popd &> /dev/null || true; rm -rf $CERTS_SET_TMP_WORK_DIR > /dev/null' RETURN
     tar xvf - <&0
 
     local CRT_FILE_SEARCH=$(find . -not -path '*/\.*' -type f -name "*.crt")
diff --git a/plugins/certs/subcommands/generate b/plugins/certs/subcommands/generate
index a0fd34262..8bec9120c 100755
--- a/plugins/certs/subcommands/generate
+++ b/plugins/certs/subcommands/generate
@@ -12,9 +12,9 @@ certs_generate_cmd() {
   local APP="$2"; local DOMAIN="$3"; local APP_SSL_PATH="$DOKKU_ROOT/$APP/tls"
 
   if [[ ! -f "$APP_SSL_PATH/server.key" ]] && [[ ! -f "$APP_SSL_PATH/server.crt" ]]; then
-    local TMP_WORK_DIR=$(mktemp -d -t "dokku_certs.XXXXXXXXX")
-    pushd "$TMP_WORK_DIR" > /dev/null
-    trap 'popd &> /dev/null || true; rm -rf "$TMP_WORK_DIR" > /dev/null' INT TERM EXIT
+    local CERTS_GENERATE_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku_certs.XXXXXXXXX")
+    pushd "$CERTS_GENERATE_TMP_WORK_DIR" > /dev/null
+    trap 'popd &> /dev/null || true; rm -rf "$CERTS_GENERATE_TMP_WORK_DIR" > /dev/null' INT TERM EXIT
 
     openssl genrsa -des3 -passout pass:x -out server.pass.key 2048
     openssl rsa -passin pass:x -in server.pass.key -out server.key
@@ -23,7 +23,7 @@ certs_generate_cmd() {
 
     mkdir -p "$APP_SSL_PATH"
     dokku_log_info1 "Installing certificate and key..."
-    mv -f "$TMP_WORK_DIR/server.key" "$TMP_WORK_DIR/server.crt" "$APP_SSL_PATH"
+    mv -f "$CERTS_GENERATE_TMP_WORK_DIR/server.key" "$CERTS_GENERATE_TMP_WORK_DIR/server.crt" "$APP_SSL_PATH"
     chmod 750 "$APP_SSL_PATH"
     chmod 640 "$APP_SSL_PATH/server.key" "$APP_SSL_PATH/server.crt"
     [[ -n "$DOMAIN" ]] && (domains_add "$APP" "$DOMAIN" || nginx_build_config "$APP")
diff --git a/plugins/checks/check-deploy b/plugins/checks/check-deploy
index c41034e47..8f2b20d64 100755
--- a/plugins/checks/check-deploy
+++ b/plugins/checks/check-deploy
@@ -58,7 +58,7 @@ checks_check_deploy() {
   eval "$(config_export global)"
   eval "$(config_export app "$APP")"
 
-  if [[ "$(is_app_checks_enabled "$APP")" == "false" ]];then
+  if [[ "$(is_app_checks_enabled "$APP")" == "false" ]]; then
     dokku_log_info2_quiet "Zero downtime checks for app ($APP) have been disabled. moving on..."
     exit 0
   fi
@@ -74,24 +74,24 @@ checks_check_deploy() {
   # docker cp exits with status 1 when run as non-root user when it tries to chown the file
   # after successfully copying the file. Thus, we suppress stderr.
   # ref: https://github.com/dotcloud/docker/issues/3986
-  local TMPDIR=$(mktemp -d /tmp/dokku_CHECKS.XXXXX)
-  docker cp $DOKKU_APP_CONTAINER_ID:/app/CHECKS "$TMPDIR" 2> /dev/null || true
+  local CHECK_DEPLOY_TMP_WORK_DIR=$(mktemp -d /tmp/dokku_CHECKS.XXXXX)
+  docker cp $DOKKU_APP_CONTAINER_ID:/app/CHECKS "$CHECK_DEPLOY_TMP_WORK_DIR" 2> /dev/null || true
 
-  local FILENAME=${TMPDIR}/CHECKS
+  local FILENAME=${CHECK_DEPLOY_TMP_WORK_DIR}/CHECKS
 
-  cleanup() {
-    declare desc="cleans up TMPDIR and print container output"
+  checks_check_deploy_cleanup() {
+    declare desc="cleans up CHECK_DEPLOY_TMP_WORK_DIR and print container output"
     local id="$1"
-    rm -rf "$TMPDIR"
+    rm -rf "$CHECK_DEPLOY_TMP_WORK_DIR" &> /dev/null || true
     if [[ $id ]]; then
       dokku_log_info2_quiet             "$APP $DOKKU_APP_CONTAINER_TYPE container output:"
       dokku_container_log_verbose_quiet "$id"
       dokku_log_info2_quiet             "end $APP $DOKKU_APP_CONTAINER_TYPE container output"
     fi
   }
-  trap 'cleanup $DOKKU_APP_CONTAINER_ID' RETURN INT TERM EXIT
+  trap 'checks_check_deploy_cleanup $DOKKU_APP_CONTAINER_ID' RETURN INT TERM EXIT
 
-  if [[ ! -s "${TMPDIR}/CHECKS" ]] || [[ "$DOKKU_APP_CONTAINER_TYPE" != "web" ]]; then
+  if [[ ! -s "${CHECK_DEPLOY_TMP_WORK_DIR}/CHECKS" ]] || [[ "$DOKKU_APP_CONTAINER_TYPE" != "web" ]]; then
     # We allow custom check for web instances only
     if [[ "$DOKKU_APP_CONTAINER_TYPE" == "web" ]]; then
       dokku_log_verbose "For more efficient zero downtime deployments, create a file CHECKS."
@@ -101,7 +101,7 @@ checks_check_deploy() {
       dokku_log_verbose "Non web container detected: Running default container check..."
     fi
 
-    rm -rf "$TMPDIR"
+    rm -rf "$CHECK_DEPLOY_TMP_WORK_DIR" &> /dev/null || true
 
     # simple default check to see if the container stuck around
     local DOKKU_DEFAULT_CHECKS_WAIT="${DOKKU_DEFAULT_CHECKS_WAIT:-10}"
@@ -115,6 +115,7 @@ checks_check_deploy() {
       dokku_log_fail "App container failed to start!!"
     fi
 
+    trap - EXIT
     dokku_log_info1 "Default container check successful!" && exit 0
   fi
 
@@ -231,6 +232,7 @@ checks_check_deploy() {
       exit 1
   fi
 
+  trap - EXIT
   dokku_log_info1 "All checks successful!"
 }
 
diff --git a/plugins/git/commands b/plugins/git/commands
index b487890b2..f7f409b02 100755
--- a/plugins/git/commands
+++ b/plugins/git/commands
@@ -10,17 +10,17 @@ git_build_app_repo() {
   local APP="$1"; local REV="$2"
 
   # clean up after ourselves
-  local TMP_WORK_DIR=$(mktemp -d -t "dokku_git.XXXX")
-  trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' RETURN INT TERM EXIT
+  local GIT_BUILD_APP_REPO_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku_git.XXXX")
+  trap 'rm -rf "$GIT_BUILD_APP_REPO_TMP_WORK_DIR" > /dev/null' RETURN INT TERM EXIT
 
 
   # git clone - this method creates a new git repository and adds the primary
   #             repo as a remote, then does a fetch depth=1 to avoid cloning
   #             the entire repo
   local TMP_TAG="dokku/$REV"
-  chmod 755 "$TMP_WORK_DIR"
+  chmod 755 "$GIT_BUILD_APP_REPO_TMP_WORK_DIR"
   unset GIT_DIR GIT_WORK_TREE
-  pushd "$TMP_WORK_DIR" > /dev/null
+  pushd "$GIT_BUILD_APP_REPO_TMP_WORK_DIR" > /dev/null
   [[ ! -d "$DOKKU_ROOT/$APP" ]] && apps_create "$APP"
   GIT_DIR="$DOKKU_ROOT/$APP" git tag -d "$TMP_TAG" &> /dev/null || true
   GIT_DIR="$DOKKU_ROOT/$APP" git tag "$TMP_TAG" "$REV" &> /dev/null
@@ -34,11 +34,11 @@ git_build_app_repo() {
   find -name .git -prune -exec rm -rf {} \; > /dev/null
 
   if [[ -f Dockerfile ]] && [[ "$([[ -f .env ]] && grep -q BUILDPACK_URL .env; echo $?)" != "0" ]] && [[ ! -f ".buildpacks" ]] && [[ -z $(config_get "$APP" BUILDPACK_URL || true) ]]; then
-    plugn trigger pre-receive-app "$APP" "dockerfile" "$TMP_WORK_DIR" "$REV"
-    dokku receive "$APP" "dockerfile" "$TMP_WORK_DIR" | sed -u "s/^/"$'\e[1G'"/"
+    plugn trigger pre-receive-app "$APP" "dockerfile" "$GIT_BUILD_APP_REPO_TMP_WORK_DIR" "$REV"
+    dokku receive "$APP" "dockerfile" "$GIT_BUILD_APP_REPO_TMP_WORK_DIR" | sed -u "s/^/"$'\e[1G'"/"
   else
-    plugn trigger pre-receive-app "$APP" "herokuish" "$TMP_WORK_DIR" "$REV"
-    dokku receive "$APP" "herokuish" "$TMP_WORK_DIR" | sed -u "s/^/"$'\e[1G'"/"
+    plugn trigger pre-receive-app "$APP" "herokuish" "$GIT_BUILD_APP_REPO_TMP_WORK_DIR" "$REV"
+    dokku receive "$APP" "herokuish" "$GIT_BUILD_APP_REPO_TMP_WORK_DIR" | sed -u "s/^/"$'\e[1G'"/"
   fi
 }
 
diff --git a/plugins/nginx-vhosts/functions b/plugins/nginx-vhosts/functions
index ae5f9ed9b..dfd43486a 100755
--- a/plugins/nginx-vhosts/functions
+++ b/plugins/nginx-vhosts/functions
@@ -155,11 +155,11 @@ nginx_build_config() {
       local PASSED_LISTEN_IP_PORT=true
     fi
 
-    local TMPDIR=$(mktemp -d /tmp/dokku_nginx_template.XXXXX)
-    local NGINX_CONF=$(mktemp -p "${TMPDIR}" -t "nginx.conf.XXXXXX")
-    local CUSTOM_NGINX_TEMPLATE="$TMPDIR/$NGINX_TEMPLATE_NAME"
+    local NGINX_BUILD_CONFIG_TMP_WORK_DIR=$(mktemp -d /tmp/dokku_nginx_template.XXXXX)
+    local NGINX_CONF=$(mktemp --tmpdir="${NGINX_BUILD_CONFIG_TMP_WORK_DIR}" "nginx.conf.XXXXXX")
+    local CUSTOM_NGINX_TEMPLATE="$NGINX_BUILD_CONFIG_TMP_WORK_DIR/$NGINX_TEMPLATE_NAME"
     # shellcheck disable=SC2086
-    trap 'rm -rf $NGINX_CONF $TMPDIR > /dev/null' RETURN INT TERM EXIT
+    trap 'rm -rf $NGINX_CONF $NGINX_BUILD_CONFIG_TMP_WORK_DIR > /dev/null' RETURN INT TERM EXIT
 
     get_custom_nginx_template "$APP" "$CUSTOM_NGINX_TEMPLATE"
     if [[ -f "$CUSTOM_NGINX_TEMPLATE" ]]; then
diff --git a/plugins/ps/functions b/plugins/ps/functions
index f91985f60..caad8b3c4 100755
--- a/plugins/ps/functions
+++ b/plugins/ps/functions
@@ -44,8 +44,8 @@ generate_scale_file() {
   if [[ ! -f $DOKKU_SCALE_FILE ]]; then
     dokku_log_info1_quiet "DOKKU_SCALE file not found in app image. Generating one based on Procfile..."
 
-    local TMP_WORK_DIR=$(mktemp -d -t "dokku_scale.XXXX")
-    trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' RETURN
+    local GENERATE_SCALE_FILE_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku_scale.XXXX")
+    trap 'rm -rf "$GENERATE_SCALE_FILE_TMP_WORK_DIR" > /dev/null' RETURN
 
     if [[ -f $DOKKU_PROCFILE ]]; then
       while read -r line || [[ -n "$line" ]]; do
diff --git a/plugins/tar/subcommands/build-locked b/plugins/tar/subcommands/build-locked
index 63b366b8f..ace52fe92 100755
--- a/plugins/tar/subcommands/build-locked
+++ b/plugins/tar/subcommands/build-locked
@@ -11,12 +11,12 @@ tar_build_locked_cmd() {
   shift 2
 
   # clean up after ourselves
-  local TMP_WORK_DIR=$(mktemp -d -t "dokku_tar.XXXX")
-  trap 'rm -rf "$TMP_WORK_DIR" > /dev/null' RETURN INT TERM EXIT
+  local TAR_BUILD_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku_tar.XXXX")
+  trap 'rm -rf "$TAR_BUILD_TMP_WORK_DIR" > /dev/null' RETURN INT TERM EXIT
 
   # extract tar file
-  chmod 755 "$TMP_WORK_DIR"
-  pushd "$TMP_WORK_DIR" > /dev/null
+  chmod 755 "$TAR_BUILD_TMP_WORK_DIR"
+  pushd "$TAR_BUILD_TMP_WORK_DIR" > /dev/null
 
   # Detect a common prefix that all files in the tar have, and strip off each directory found in it
   local COMMON_PREFIX=$(tar -tf "$DOKKU_ROOT/$APP/src.tar" | sed -e 'N;s/^\(.*\).*\n\1.*$/\1\n\1/;D')
@@ -24,15 +24,15 @@ tar_build_locked_cmd() {
 
   dokku_log_info1_quiet "Striping $BOGUS_PARTS worth of directories from tarball"
 
-  tar -x -C "$TMP_WORK_DIR" -f "$DOKKU_ROOT/$APP/src.tar" --strip-components="$BOGUS_PARTS"
-  chmod -R u+r "$TMP_WORK_DIR"
+  tar -x -C "$TAR_BUILD_TMP_WORK_DIR" -f "$DOKKU_ROOT/$APP/src.tar" --strip-components="$BOGUS_PARTS"
+  chmod -R u+r "$TAR_BUILD_TMP_WORK_DIR"
 
   if [[ -f Dockerfile ]] && [[ "$([[ -f .env ]] && grep -q BUILDPACK_URL .env; echo $?)" != "0" ]] && [[ ! -f ".buildpacks" ]]; then
-    plugn trigger pre-receive-app "$APP" "dockerfile" "$TMP_WORK_DIR"
-    dokku receive "$APP" "dockerfile" "$TMP_WORK_DIR" | sed -u "s/^/"$'\e[1G'"/"
+    plugn trigger pre-receive-app "$APP" "dockerfile" "$TAR_BUILD_TMP_WORK_DIR"
+    dokku receive "$APP" "dockerfile" "$TAR_BUILD_TMP_WORK_DIR" | sed -u "s/^/"$'\e[1G'"/"
   else
-    plugn trigger pre-receive-app "$APP" "herokuish" "$TMP_WORK_DIR"
-    dokku receive "$APP" "herokuish" "$TMP_WORK_DIR" | sed -u "s/^/"$'\e[1G'"/"
+    plugn trigger pre-receive-app "$APP" "herokuish" "$TAR_BUILD_TMP_WORK_DIR"
+    dokku receive "$APP" "herokuish" "$TAR_BUILD_TMP_WORK_DIR" | sed -u "s/^/"$'\e[1G'"/"
   fi
 }
 
diff --git a/tests/test_deploy b/tests/test_deploy
index 473f65ba6..200e126a8 100755
--- a/tests/test_deploy
+++ b/tests/test_deploy
@@ -22,7 +22,7 @@ succeeded() {
   exit 1
 }
 
-TMP=$(mktemp -d -t "$TARGET.XXXXX")
+TMP=$(mktemp -d "/tmp/$TARGET.XXXXX")
 rmdir "$TMP" && cp -r "$(dirname "$SELF")/$APP" "$TMP"
 
 pushd "$TMP" &> /dev/null || exit 1
diff --git a/tests/unit/10_tar.bats b/tests/unit/10_tar.bats
index 20a061ffe..64c23ff0b 100644
--- a/tests/unit/10_tar.bats
+++ b/tests/unit/10_tar.bats
@@ -12,7 +12,7 @@ teardown() {
 
 deploy_app_tar() {
   APP_TYPE="$1"; APP_TYPE=${APP_TYPE:="nodejs-express"}
-  TMP=$(mktemp -d -t "dokku.me.XXXXX")
+  TMP=$(mktemp -d "/tmp/dokku.me.XXXXX")
 
   rmdir "$TMP" && cp -r "./tests/apps/$APP_TYPE" "$TMP"
   pushd "$TMP" &> /dev/null || exit 1
diff --git a/tests/unit/test_helper.bash b/tests/unit/test_helper.bash
index 3fb4bc5cf..96414e1ce 100644
--- a/tests/unit/test_helper.bash
+++ b/tests/unit/test_helper.bash
@@ -176,7 +176,7 @@ assert_http_redirect() {
 deploy_app() {
   local APP_TYPE="$1"; local APP_TYPE=${APP_TYPE:="nodejs-express"}
   local GIT_REMOTE="$2"; local GIT_REMOTE=${GIT_REMOTE:="dokku@dokku.me:$TEST_APP"}
-  local CUSTOM_TEMPLATE="$3"; local TMP=$(mktemp -d -t "dokku.me.XXXXX")
+  local CUSTOM_TEMPLATE="$3"; local TMP=$(mktemp -d "/tmp/dokku.me.XXXXX")
   local CUSTOM_PATH="$4"
 
   rmdir "$TMP" && cp -r "./tests/apps/$APP_TYPE" "$TMP"
@@ -200,7 +200,7 @@ deploy_app() {
 }
 
 setup_client_repo() {
-  local TMP=$(mktemp -d -t "dokku.me.XXXXX")
+  local TMP=$(mktemp -d "/tmp/dokku.me.XXXXX")
   rmdir "$TMP" && cp -r ./tests/apps/nodejs-express "$TMP"
   cd "$TMP" || exit 1
   git init