diff --git a/http-download.cabal b/http-download.cabal
--- a/http-download.cabal
+++ b/http-download.cabal
@@ -1,17 +1,18 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.31.1.
+-- This file has been generated from package.yaml by hpack version 0.31.2.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: b6a9c41e4facbc95bcb9ee81b15c8c682b88f638fa8df0382f9e4e54b6ab1629
+-- hash: 8b4f895c68c59d6ced8926b73292a062ce3b3f53859ca9b40d11c85f39e2fbf2
 
 name:           http-download
-version:        0.1.0.0
+version:        0.1.0.1
 synopsis:       Verified downloads with retries
+description:    Higher level HTTP download APIs include verification of content and retries
 category:       Development
-homepage:       https://github.com/commercialhaskell/stack#readme
-bug-reports:    https://github.com/commercialhaskell/stack/issues
+homepage:       https://github.com/commercialhaskell/http-download#readme
+bug-reports:    https://github.com/commercialhaskell/http-download/issues
 author:         Michael Snoyman
 maintainer:     michael@snoyman.com
 copyright:      2018-2019 FP Complete
@@ -21,7 +22,7 @@
 
 source-repository head
   type: git
-  location: https://github.com/commercialhaskell/stack
+  location: https://github.com/commercialhaskell/http-download
 
 library
   exposed-modules:
diff --git a/src/Network/HTTP/Download/Verified.hs b/src/Network/HTTP/Download/Verified.hs
--- a/src/Network/HTTP/Download/Verified.hs
+++ b/src/Network/HTTP/Download/Verified.hs
@@ -20,7 +20,7 @@
 
 import qualified    Data.List as List
 import qualified    Data.ByteString.Base64 as B64
-import              Conduit (withSinkFile)
+import              Conduit (sinkHandle)
 import qualified    Data.Conduit.Binary as CB
 import qualified    Data.Conduit.List as CL
 
@@ -45,7 +45,8 @@
 import qualified    RIO.ByteString as ByteString
 import qualified    RIO.Text as Text
 import              System.Directory
-import qualified    System.FilePath as FP ((<.>))
+import qualified    System.FilePath as FP
+import              System.IO (openTempFileWithDefaultPermissions)
 
 -- | A request together with some checks to perform.
 data DownloadRequest = DownloadRequest
@@ -249,16 +250,17 @@
     whenM' (liftIO getShouldDownload) $ do
         logDebug $ "Downloading " <> display (decodeUtf8With lenientDecode (path req))
         liftIO $ createDirectoryIfMissing True dir
-        recoveringHttp drRetryPolicy $
-            withSinkFile fptmp $ httpSink req . go
-        liftIO $ renameFile fptmp fp
+        withTempFileWithDefaultPermissions dir (FP.takeFileName fp) $ \fptmp htmp -> do
+            recoveringHttp drRetryPolicy $
+                httpSink req $ go (sinkHandle htmp)
+            hClose htmp
+            liftIO $ renameFile fptmp fp
   where
     whenM' mp m = do
         p <- mp
         if p then m >> return True else return False
 
     fp = toFilePath destpath
-    fptmp = fp FP.<.> "tmp"
     dir = toFilePath $ parent destpath
 
     getShouldDownload = do
@@ -322,3 +324,21 @@
                   *> maybe (pure ()) (assertLengthSink drRequest) drLengthCheck
                   *> ZipSink sink
                   *> ZipSink (progressSink mcontentLength))
+
+
+
+-- | Like 'UnliftIO.Temporary.withTempFile', but the file is created with
+--   default file permissions, instead of read/write access only for the owner.
+withTempFileWithDefaultPermissions
+             :: MonadUnliftIO m
+             => FilePath -- ^ Temp dir to create the file in.
+             -> String   -- ^ File name template. See 'openTempFile'.
+             -> (FilePath -> Handle -> m a) -- ^ Callback that can use the file.
+             -> m a
+withTempFileWithDefaultPermissions tmpDir template action =
+  bracket
+    (liftIO (openTempFileWithDefaultPermissions tmpDir template))
+    (\(name, handle') -> liftIO (hClose handle' >> ignoringIOErrors (removeFile name)))
+    (uncurry action)
+  where
+    ignoringIOErrors = void. tryIO