diff --git a/pkgs/build-support/rust/fetchcargo.nix b/pkgs/build-support/rust/fetchcargo.nix
index c23fa66ef9f0..13d52e383379 100644
--- a/pkgs/build-support/rust/fetchcargo.nix
+++ b/pkgs/build-support/rust/fetchcargo.nix
@@ -38,18 +38,19 @@ stdenv.mkDerivation {
     fi
 
     export CARGO_HOME=$(mktemp -d cargo-home.XXX)
+    CARGO_CONFIG=$(mktemp cargo-config.XXXX)
 
     ${cargoUpdateHook}
 
     mkdir -p $out
-    cargo vendor $out | cargo-vendor-normalise > config
+    cargo vendor $out | cargo-vendor-normalise > $CARGO_CONFIG
     # fetchcargo used to never keep the config output by cargo vendor
     # and instead hardcode the config in ./fetchcargo-default-config.toml.
     # This broke on packages needing git dependencies, so now we keep the config.
     # But not to break old cargoSha256, if the previous behavior was enough,
     # we don't store the config.
-    if ! cmp config ${./fetchcargo-default-config.toml} > /dev/null; then
-      install -Dt $out/.cargo config;
+    if ! cmp $CARGO_CONFIG ${./fetchcargo-default-config.toml} > /dev/null; then
+      install -Dt $out/.cargo $CARGO_CONFIG;
     fi;
   '';