diff --git a/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh b/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
index 5a17b0518357..df9e6918ac56 100755
--- a/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
+++ b/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
@@ -1,9 +1,18 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -i bash -p coreutils jq nix -I nixpkgs=.
 
+set -euo pipefail
+
+TMP_TEMPLATE=transitive-broken.XXXXXXX
+readonly TMP_TEMPLATE
+
+tmpfile=$(mktemp "$TMP_TEMPLATE")
+
+trap 'rm "${tmpfile}"' 0
+
 config_file=pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
 
-cat > $config_file << EOF
+cat > $tmpfile << EOF
 # This file is automatically generated by
 # maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
 # It is supposed to list all haskellPackages that cannot evaluate because they
@@ -11,4 +20,6 @@ cat > $config_file << EOF
 dont-distribute-packages:
 EOF
 
-nix-instantiate --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort -i >> $config_file
+nix-instantiate --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort -i >> $tmpfile
+
+mv $tmpfile $config_file