diff --git a/jsonnet/kube-prometheus/components/grafana.libsonnet b/jsonnet/kube-prometheus/components/grafana.libsonnet
index a89e170e92d98bc6f28a97e39362fa130fbb7fed..beca7a0c153f704a2e7a4ee415ed614efb694844 100644
--- a/jsonnet/kube-prometheus/components/grafana.libsonnet
+++ b/jsonnet/kube-prometheus/components/grafana.libsonnet
@@ -100,7 +100,16 @@ function(params)
                 readOnlyRootFilesystem: true,
                 capabilities: { drop: ['ALL'] },
               },
+              volumeMounts+: [{
+                mountPath: '/tmp',
+                name: 'tmp-plugins',
+                readOnly: false,
+              }],
             }, super.containers),
+            volumes+: [{
+              name: 'tmp-plugins',
+              emptyDir: {},
+            }],
           },
         },
       },
diff --git a/manifests/grafana-deployment.yaml b/manifests/grafana-deployment.yaml
index 0a1bbbd20713ce41122a180c17767d77033e1c6f..c44de98142956e5c1e5b974bc7351f9e4ada9129 100644
--- a/manifests/grafana-deployment.yaml
+++ b/manifests/grafana-deployment.yaml
@@ -137,6 +137,9 @@ spec:
         - mountPath: /etc/grafana
           name: grafana-config
           readOnly: false
+        - mountPath: /tmp
+          name: tmp-plugins
+          readOnly: false
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:
@@ -228,3 +231,5 @@ spec:
       - name: grafana-config
         secret:
           secretName: grafana-config
+      - emptyDir: {}
+        name: tmp-plugins