diff --git a/.gitea/workflows/sync-github-mirror.yml b/.gitea/workflows/sync-github-mirror.yml
index edd9495..41185c7 100644
--- a/.gitea/workflows/sync-github-mirror.yml
+++ b/.gitea/workflows/sync-github-mirror.yml
@@ -48,24 +48,26 @@ jobs:
           SRC_SHA="$(git rev-parse --short HEAD)"
 
           # Clone the GitHub mirror into a sibling working dir
-          git clone --depth=1 "https://x-access-token:${GH_MIRROR_TOKEN}@github.com/${GH_REPO}.git" gh-mirror
+          GH_DIR="${RUNNER_TEMP:-/tmp}/awc-gh-mirror"; rm -rf "$GH_DIR"; git clone --depth=1 "https://x-access-token:${GH_MIRROR_TOKEN}@github.com/${GH_REPO}.git" "$GH_DIR"
 
           # Mirror this checkout's tree into gh-mirror/ with the exclusions.
           # --delete drops files removed on the source; --exclude='.git' protects
           # both repos' .git dirs from rsync touching them.
+          # belt-and-suspenders exclude of the clone dir name in case anyone re-uses ./gh-mirror.
           rsync -a --delete \
             --exclude='.git' \
             --exclude='.gitea/' \
             --exclude='.claude/' \
             --exclude='blog/' \
             --exclude='handoff.md' \
+            --exclude='gh-mirror/' \
             --exclude='__pycache__/' \
             --exclude='*.pyc' \
             --exclude='tasks.json' \
             --exclude='.DS_Store' \
-            ./ gh-mirror/
+            ./ "$GH_DIR"/
 
-          cd gh-mirror
+          cd "$GH_DIR"
           git add -A
           if git diff --cached --quiet; then
             echo "no relevant changes for the mirror (source push only touched excluded paths); skipping"