diff --git a/playwright.config.ts b/playwright.config.ts
index 533ad8b6..142934f1 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -10,4 +10,5 @@ export default defineConfig({
   retries: process.env.CI ? 1 : 0,
   reporter: process.env.CI ? [['list'], ['html', { open: 'never' }]] : 'list',
   use: { trace: 'retain-on-failure' },
+  globalSetup: './tests/run-tmp.ts',
 })
diff --git a/tests/run-tmp.ts b/tests/run-tmp.ts
new file mode 100644
index 00000000..cec57981
--- /dev/null
+++ b/tests/run-tmp.ts
@@ -0,0 +1,20 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+/**
+ * Global setup for both test runners: on Linux, one temp folder per run, removed when the run
+ * ends. Workers, and the apps they launch, inherit `TMPDIR`, so every folder a test makes with
+ * `tmpdir()` (an app's user data, a download folder, a saved page) and the apps' own temp files
+ * go under it. Before, each e2e test left its user data in /tmp: about 3 MB a test, over 1 GB a
+ * full run. A run that is killed leaves its one folder behind.
+ *
+ * Linux only: on Windows `tmpdir()` reads TEMP and TMP, not `TMPDIR`, and nothing runs the suite
+ * on macOS or Windows now (D42), so it's untested there.
+ */
+export default function runTmp(): () => void {
+  if (process.platform !== 'linux') return () => {}
+  const dir = mkdtempSync(join(tmpdir(), 'orbit-run-'))
+  process.env.TMPDIR = dir
+  return () => rmSync(dir, { recursive: true, force: true })
+}
diff --git a/vitest.config.ts b/vitest.config.ts
index f58daa18..4eb2d9bd 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -4,6 +4,7 @@ export default defineConfig({
   test: {
     include: ['tests/unit/**/*.test.ts'],
     environment: 'node',
+    globalSetup: ['tests/run-tmp.ts'],
     // Persistence tests fsync real files; CI disks (macOS runners) can take seconds.
     testTimeout: 15_000,
   },