diff --git a/src/main/domain/managed-tools.test.ts b/src/main/domain/managed-tools.test.ts
index 6d45ba6..0f81ee4 100644
--- a/src/main/domain/managed-tools.test.ts
+++ b/src/main/domain/managed-tools.test.ts
@@ -107,6 +107,18 @@ afterEach(() => {
 });
 
 describe('managed tool installer', () => {
+    it('stages the downloaded archive under a unique path that keeps the .zip extension', async () => {
+        const { installer, download } = createInstaller();
+
+        const result = await installer.repair(manifest());
+
+        expect(result.success).toBe(true);
+        expect(download).toHaveBeenCalledTimes(1);
+        const archivePath = download.mock.calls[0][1];
+        expect(path.extname(archivePath)).toBe('.zip');
+        expect(path.basename(archivePath)).not.toBe(manifest().archiveName);
+    });
+
     it('retains the working installation when the downloaded archive hash is corrupted', async () => {
         const { installer, installPath, download } = createInstaller({ archiveContents: 'corrupted archive' });
         writeExistingInstallation(installPath);
diff --git a/src/main/domain/managed-tools.ts b/src/main/domain/managed-tools.ts
index 97c1b02..55026b5 100644
--- a/src/main/domain/managed-tools.ts
+++ b/src/main/domain/managed-tools.ts
@@ -217,7 +217,7 @@ export class ManagedToolInstaller {
 
     private async installOnce(manifest: ExternalToolManifest): Promise<ManagedToolInstallResult> {
         const uniqueSuffix = crypto.randomUUID();
-        const archivePath = path.join(this.options.temporaryDirectory, `${manifest.archiveName}.${uniqueSuffix}`);
+        const archivePath = path.join(this.options.temporaryDirectory, `${uniqueSuffix}-${manifest.archiveName}`);
         const stagingDirectory = `${this.options.installationDirectory}.stage-${uniqueSuffix}`;
         const diagnostics: string[] = [];