diff --git a/.api-sync/delivery.json b/.api-sync/delivery.json
deleted file mode 100644
index 3a31c85..0000000
--- a/.api-sync/delivery.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "source_repository": "blindpaylabs/blindpay-v2",
-  "source_sha": "d86390e2f9f9915598c039c153ec5cab7832ff89",
-  "spec_sha256": "8d41023418c772aa3e4206e357c0963326b2f38336121ad5424d90d666352da9",
-  "generated_at": "2026-08-04T18:01:58Z"
-}
diff --git a/.github/workflows/api-sync.yml b/.github/workflows/api-sync.yml
index 79f3155..b93572f 100644
--- a/.github/workflows/api-sync.yml
+++ b/.github/workflows/api-sync.yml
@@ -30,19 +30,19 @@ jobs:
         run: |
           set -e
           git fetch origin api-sync-data
-          mkdir -p .api-sync
+          mkdir -p /tmp/api-sync
 
-          if ! git show origin/api-sync-data:.api-sync/spec-current.json > .api-sync/spec-current.json; then
+          if ! git show origin/api-sync-data:.api-sync/spec-current.json > /tmp/api-sync/spec-current.json; then
             echo "::error::.api-sync/spec-current.json is missing on the api-sync-data branch."
             exit 1
           fi
-          if ! git show origin/api-sync-data:.api-sync/delivery.json > .api-sync/delivery.json; then
+          if ! git show origin/api-sync-data:.api-sync/delivery.json > /tmp/api-sync/delivery.json; then
             echo "::error::.api-sync/delivery.json is missing on the api-sync-data branch."
             exit 1
           fi
 
-          MANIFEST_SHA256=$(jq -r '.spec_sha256' .api-sync/delivery.json)
-          ACTUAL_SHA256=$(sha256sum .api-sync/spec-current.json | cut -d' ' -f1)
+          MANIFEST_SHA256=$(jq -r '.spec_sha256' /tmp/api-sync/delivery.json)
+          ACTUAL_SHA256=$(sha256sum /tmp/api-sync/spec-current.json | cut -d' ' -f1)
           if [ "$MANIFEST_SHA256" != "$ACTUAL_SHA256" ]; then
             echo "::error::spec-current.json sha256 ($ACTUAL_SHA256) does not match delivery.json's spec_sha256 ($MANIFEST_SHA256)."
             exit 1
@@ -54,7 +54,7 @@ jobs:
           fi
 
           echo "Verified spec-current.json (sha256 $ACTUAL_SHA256) against delivery.json:"
-          jq -r '"  source_repository: \(.source_repository)\n  source_sha: \(.source_sha)\n  generated_at: \(.generated_at)"' .api-sync/delivery.json
+          jq -r '"  source_repository: \(.source_repository)\n  source_sha: \(.source_sha)\n  generated_at: \(.generated_at)"' /tmp/api-sync/delivery.json
 
       - name: Check for existing api-sync PR
         id: check-pr
@@ -93,7 +93,7 @@ jobs:
         id: sync
         run: |
           set +e
-          bun scripts/api-sync/index.ts --apply --spec .api-sync/spec-current.json --report /tmp/sync-report.json
+          bun scripts/api-sync/index.ts --apply --spec /tmp/api-sync/spec-current.json --report /tmp/sync-report.json
           echo "exit_code=$?" >> "$GITHUB_OUTPUT"
           set -e
           echo "bump=$(jq -r '.bump' /tmp/sync-report.json)" >> "$GITHUB_OUTPUT"
diff --git a/.gitignore b/.gitignore
index 75cf9d6..bca2a88 100644
--- a/.gitignore
+++ b/.gitignore
@@ -64,3 +64,4 @@ dist
 
 # api-sync: delivered fresh each CI run from the api-sync-data branch, never committed
 .api-sync/spec-current.json
+.api-sync/delivery.json