diff --git a/.github/workflows/go-ci.yaml b/.github/workflows/go-ci.yaml
index d551a1c..0ae8c4c 100644
--- a/.github/workflows/go-ci.yaml
+++ b/.github/workflows/go-ci.yaml
@@ -270,11 +270,12 @@ jobs:
             echo "::warning::Coverage report format changed — Summary Complexity not patched. Check CodeCoverageSummary version."
           fi
 
-          : > /tmp/cov-func.txt
+          COV_FUNC="$RUNNER_TEMP/cov-func.txt"
+          : > "$COV_FUNC"
           while IFS= read -r mod; do
             [ -z "$mod" ] && continue
             safe=$(echo "$mod" | tr '/' '_')
-            (cd "$mod" && go tool cover -func="$GITHUB_WORKSPACE/coverage/$safe.out") >> /tmp/cov-func.txt
+            (cd "$mod" && go tool cover -func="$GITHUB_WORKSPACE/coverage/$safe.out") >> "$COV_FUNC"
           done <<< "$MODULES"
 
           {
@@ -290,7 +291,7 @@ jobs:
                 echo "| ${complexity} | \`${func}\` | \`${location}\` | ? parse |"
                 continue
               fi
-              if pct=$(grep -F "${file_line}:" /tmp/cov-func.txt | head -1 | awk 'NF{print $NF}') && [ -n "${pct}" ]; then
+              if pct=$(grep -F "${file_line}:" "$COV_FUNC" | head -1 | awk 'NF{print $NF}') && [ -n "${pct}" ]; then
                 case "${pct}" in
                   0.0%) attended="✗ 0.0%" ;;
                   *)    attended="✓ ${pct}" ;;
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8e87d2..eb28949 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Fix `go-ci.yaml`'s `Augment coverage report with cyclomatic complexity` step staging per-function coverage output at the fixed path `/tmp/cov-func.txt`. On shared self-hosted runners (e.g. the Hetzner pool) `/tmp` outlives the job and is shared across runner instances, so a leftover file owned by a different runner user fails the step with `permission denied`, and two Go jobs landing on the same host can interleave writes and stamp the wrong per-function coverage into each other's `Attended` column. The staging file now lives under `$RUNNER_TEMP`, which is private to the runner instance and wiped between jobs; GitHub-hosted consumers see no change. Closes out the self-hosted-runner hardening of this step begun in 2.3.2's sudo removal. (#12)
+
 ## [2.3.4] - 2026-07-10
 
 ### Fixed