diff --git a/Cargo.lock b/Cargo.lock
index e4e786b..0be57a9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3492,6 +3492,7 @@ dependencies = [
  "pin-project",
  "portpicker",
  "prometheus",
+ "rand 0.8.5",
  "reqwest",
  "routefinder",
  "semver 1.0.22",
diff --git a/Cargo.toml b/Cargo.toml
index 4d24016..5bd2c6f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -66,6 +66,7 @@ tracing-log = "0.2"
 tracing-subscriber = { version = "0.3.18", features = ["env-filter", "json"] }
 url = "2.5.0"
 vbs = "0.1"
+rand = "0.8"
 
 # Dependencies enabled by feature `testing`
 async-compatibility-layer = { version = "1.1", features = ["logging-utils"], optional = true }
diff --git a/src/app.rs b/src/app.rs
index 825e3c2..1d0c764 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -22,6 +22,7 @@ use futures::future::{BoxFuture, FutureExt};
 use include_dir::{include_dir, Dir};
 use lazy_static::lazy_static;
 use maud::{html, PreEscaped};
+use rand::Rng;
 use semver::Version;
 use serde::{Deserialize, Serialize};
 use serde_with::{serde_as, DisplayFromStr};
@@ -269,10 +270,14 @@ impl<State: Send + Sync + 'static, Error: 'static> App<State, Error> {
 static DEFAULT_PUBLIC_DIR: Dir<'_> = include_dir!("$CARGO_MANIFEST_DIR/public/media");
 lazy_static! {
     static ref DEFAULT_PUBLIC_PATH: PathBuf = {
+        // Generate a random number to index into `/tmp` with
+        let mut rng = rand::thread_rng();
+        let index: u64 = rng.gen();
+
         // The contents of the default public directory are included in the binary. The first time
         // the default directory is used, if ever, we extract them to a directory on the host file
         // system and return the path to that directory.
-        let path = PathBuf::from("/tmp/tide-disco/public/media");
+        let path = PathBuf::from(format!("/tmp/tide-disco/{}/public/media", index));
         // If the path already exists, move it aside so we can update it.
         let _ = fs::rename(&path, path.with_extension("old"));
         DEFAULT_PUBLIC_DIR.extract(&path).unwrap();