diff --git a/Cargo.toml b/Cargo.toml
index e7e897c..5904970 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,11 +28,8 @@ portable-pty = { version = "0.9", default-features = false }
 tungstenite = { version = "0.28", default-features = false, features = ["handshake"] }
 tar = { version = "0.4", default-features = false }
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
-
-[dev-dependencies]
 tempfile = "3"
 
 [profile.release]
 lto = "thin"
 strip = true
-
diff --git a/src/apk.rs b/src/apk.rs
index 16e7647..d404d9e 100644
--- a/src/apk.rs
+++ b/src/apk.rs
@@ -3660,6 +3660,26 @@ setup_props
                 let command = u.path().trim_end_matches('/').rsplit('/').next().unwrap();
                 calls.push(command.to_owned());
                 let response = PathBuf::from(&q["response"]);
+                // Frame's Steam client does not write Devkit replies into
+                // Framely's persistent home directory. Keep this fixture
+                // stricter than a generic FIFO responder.
+                assert_eq!(response.parent().unwrap().parent(), Some(Path::new("/tmp")));
+                assert!(response
+                    .parent()
+                    .unwrap()
+                    .file_name()
+                    .unwrap()
+                    .to_str()
+                    .unwrap()
+                    .starts_with("framely-steam-rpc-"));
+                assert_eq!(
+                    fs::metadata(response.parent().unwrap())
+                        .unwrap()
+                        .permissions()
+                        .mode()
+                        & 0o777,
+                    0o700
+                );
                 match command {
                     "create-shortcut" if fail => {
                         fail = false;
diff --git a/src/apk/steam_shortcuts.rs b/src/apk/steam_shortcuts.rs
index 527d873..ae5e31b 100644
--- a/src/apk/steam_shortcuts.rs
+++ b/src/apk/steam_shortcuts.rs
@@ -71,14 +71,14 @@ pub(super) fn rpc(home: &Path, command: &str, id: Option<&str>) -> Result<String
     );
     let pid = fs::read_to_string(steam.join("steam.pid"))?;
     ensure!(runtime_pid_alive(pid.trim()), "Steam is not running");
-    let directory = root(home).join("steam/responses");
-    fs::create_dir_all(&directory)?;
-    ensure!(
-        fs::symlink_metadata(&directory)?.is_dir(),
-        "Invalid Steam response directory"
-    );
-    fs::set_permissions(&directory, fs::Permissions::from_mode(0o700))?;
-    let response = directory.join(hex::encode(rand::random::<[u8; 16]>()));
+    // Steam's Devkit response writer accepts /tmp paths, but silently ignores
+    // responses in the application's persistent home directory on Frame.
+    // Match Valve's helper, using a private directory independent of TMPDIR.
+    let directory = tempfile::Builder::new()
+        .prefix("framely-steam-rpc-")
+        .tempdir_in("/tmp")?;
+    fs::set_permissions(directory.path(), fs::Permissions::from_mode(0o700))?;
+    let response = directory.path().join("response");
     let mut q = url::form_urlencoded::Serializer::new(String::new());
     q.append_pair(
         "response",