diff --git a/audio/src/fetch/mod.rs b/audio/src/fetch/mod.rs
index 97037d6e..c4f6c72f 100644
--- a/audio/src/fetch/mod.rs
+++ b/audio/src/fetch/mod.rs
@@ -406,8 +406,7 @@ impl AudioFileStreaming {
             read_position: AtomicUsize::new(0),
         });
 
-        // TODO : use new_in() to store securely in librespot directory
-        let write_file = NamedTempFile::new().unwrap();
+        let write_file = NamedTempFile::new_in(session.config().tmp_dir.clone()).unwrap();
         let read_file = write_file.reopen().unwrap();
 
         let (stream_loader_command_tx, stream_loader_command_rx) =
diff --git a/core/src/config.rs b/core/src/config.rs
index b8c448c2..24b6a88e 100644
--- a/core/src/config.rs
+++ b/core/src/config.rs
@@ -1,4 +1,5 @@
 use std::fmt;
+use std::path::PathBuf;
 use std::str::FromStr;
 use url::Url;
 
@@ -8,6 +9,7 @@ pub struct SessionConfig {
     pub device_id: String,
     pub proxy: Option<Url>,
     pub ap_port: Option<u16>,
+    pub tmp_dir: PathBuf,
 }
 
 impl Default for SessionConfig {
@@ -18,6 +20,7 @@ impl Default for SessionConfig {
             device_id,
             proxy: None,
             ap_port: None,
+            tmp_dir: std::env::temp_dir(),
         }
     }
 }
diff --git a/src/main.rs b/src/main.rs
index 0dce723a..8ff9f8b6 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -26,8 +26,9 @@ mod player_event_handler;
 use player_event_handler::{emit_sink_event, run_program_on_events};
 
 use std::env;
+use std::fs::create_dir_all;
 use std::ops::RangeInclusive;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 use std::pin::Pin;
 use std::process::exit;
 use std::str::FromStr;
@@ -228,6 +229,7 @@ fn get_setup() -> Setup {
     const PROXY: &str = "proxy";
     const QUIET: &str = "quiet";
     const SYSTEM_CACHE: &str = "system-cache";
+    const TEMP_DIR: &str = "tmp";
     const USERNAME: &str = "username";
     const VERBOSE: &str = "verbose";
     const VERSION: &str = "version";
@@ -266,6 +268,7 @@ fn get_setup() -> Setup {
     const ALSA_MIXER_DEVICE_SHORT: &str = "S";
     const ALSA_MIXER_INDEX_SHORT: &str = "s";
     const ALSA_MIXER_CONTROL_SHORT: &str = "T";
+    const TEMP_DIR_SHORT: &str = "t";
     const NORMALISATION_ATTACK_SHORT: &str = "U";
     const USERNAME_SHORT: &str = "u";
     const VERSION_SHORT: &str = "V";
@@ -279,7 +282,7 @@ fn get_setup() -> Setup {
     const NORMALISATION_THRESHOLD_SHORT: &str = "Z";
     const ZEROCONF_PORT_SHORT: &str = "z";
 
-    // Options that have different desc's
+    // Options that have different descriptions
     // depending on what backends were enabled at build time.
     #[cfg(feature = "alsa-backend")]
     const MIXER_TYPE_DESC: &str = "Mixer to use {alsa|softvol}. Defaults to softvol.";
@@ -411,10 +414,16 @@ fn get_setup() -> Setup {
         "Displayed device type. Defaults to speaker.",
         "TYPE",
     )
+    .optopt(
+        TEMP_DIR_SHORT,
+        TEMP_DIR,
+        "Path to a directory where files will be temporarily stored while downloading.",
+        "PATH",
+    )
     .optopt(
         CACHE_SHORT,
         CACHE,
-        "Path to a directory where files will be cached.",
+        "Path to a directory where files will be cached after downloading.",
         "PATH",
     )
     .optopt(
@@ -912,6 +921,15 @@ fn get_setup() -> Setup {
         }
     };
 
+    let tmp_dir = opt_str(TEMP_DIR).map_or(SessionConfig::default().tmp_dir, |p| {
+        let tmp_dir = PathBuf::from(p);
+        if let Err(e) = create_dir_all(&tmp_dir) {
+            error!("could not create or access specified tmp directory: {}", e);
+            exit(1);
+        }
+        tmp_dir
+    });
+
     let cache = {
         let volume_dir = opt_str(SYSTEM_CACHE)
             .or_else(|| opt_str(CACHE))
@@ -1162,6 +1180,7 @@ fn get_setup() -> Setup {
                 exit(1);
             }
         }),
+		tmp_dir,
     };
 
     let player_config = {