diff --git a/lib/manager/composer/lock-file.js b/lib/manager/composer/lock-file.js
index c96efc1eea69c7c00dfc8f60d351e144903d219e..d736d75e664285bafdd137a7330cbbafa301627e 100644
--- a/lib/manager/composer/lock-file.js
+++ b/lib/manager/composer/lock-file.js
@@ -1,6 +1,5 @@
 const { exec } = require('child-process-promise');
 const fs = require('fs-extra');
-const tmp = require('tmp-promise');
 const upath = require('upath');
 
 const endpoints = require('../../util/endpoints');
@@ -12,7 +11,8 @@ module.exports = {
 async function getLockFile(
   packageFileName,
   updatedDeps,
-  newPackageFileContent
+  newPackageFileContent,
+  config
 ) {
   logger.debug(`composer.getLockFile(${packageFileName})`);
   const lockFileName = packageFileName.replace(/\.json$/, '.lock');
@@ -21,19 +21,18 @@ async function getLockFile(
     logger.debug('No composer.lock found');
     return null;
   }
-  const tmpDir = await tmp.dir({ unsafeCleanup: true });
-  const cwd = upath.join(tmpDir.path, upath.dirname(packageFileName));
+  const cwd = upath.join(config.localDir, upath.dirname(packageFileName));
   let stdout;
   let stderr;
   try {
-    const localPackageFileName = upath.join(tmpDir.path, packageFileName);
+    const localPackageFileName = upath.join(config.localDir, packageFileName);
     const newPackageFileParsed = JSON.parse(newPackageFileContent);
     delete newPackageFileParsed.scripts;
     await fs.outputFile(
       localPackageFileName,
       JSON.stringify(newPackageFileParsed)
     );
-    const localLockFileName = upath.join(tmpDir.path, lockFileName);
+    const localLockFileName = upath.join(config.localDir, lockFileName);
     await fs.outputFile(localLockFileName, existingLockFileContent);
     const credentials = endpoints.find({
       platform: 'github',
@@ -84,7 +83,5 @@ async function getLockFile(
       'Failed to generate composer.lock'
     );
     return null;
-  } finally {
-    tmpDir.cleanup();
   }
 }
diff --git a/lib/workers/branch/get-updated.js b/lib/workers/branch/get-updated.js
index bb58f945470d6e381a72e267975fd71a466c0bbb..a3597965eb5a56a6b16d74a1687d9da9f0035992 100644
--- a/lib/workers/branch/get-updated.js
+++ b/lib/workers/branch/get-updated.js
@@ -61,7 +61,8 @@ async function getUpdatedPackageFiles(config) {
       const updatedLockFile = await getLockFile(
         packageFile.name,
         updatedDeps,
-        packageFile.contents
+        packageFile.contents,
+        config
       );
       if (updatedLockFile) {
         updatedLockFiles.push(updatedLockFile);
diff --git a/lib/workers/repository/index.js b/lib/workers/repository/index.js
index a0f9e84e08b74fbf4748c3c56144aba8684b022d..7ed1c0cc103b9ce2fe2140111bfbfdc69fd09a7c 100644
--- a/lib/workers/repository/index.js
+++ b/lib/workers/repository/index.js
@@ -1,3 +1,5 @@
+const tmp = require('tmp-promise');
+
 const { initRepo } = require('./init');
 const { ensureOnboardingPr } = require('./onboarding/pr');
 const { handleError } = require('./error');
@@ -15,7 +17,13 @@ async function renovateRepository(repoConfig) {
   logger.setMeta({ repository: config.repository });
   logger.info('Renovating repository');
   logger.trace({ config });
+  let tmpDir;
   try {
+    if (!config.localDir) {
+      // Use an ephemeral directory if none configured
+      tmpDir = await tmp.dir({ unsafeCleanup: true });
+      config.localDir = tmpDir.path;
+    }
     config = await initRepo(config);
     const { res, branches, branchList, packageFiles } = await processRepo(
       config
@@ -27,6 +35,9 @@ async function renovateRepository(repoConfig) {
     return processResult(config, await handleError(config, err));
   } finally {
     platform.cleanRepo();
+    if (tmpDir) {
+      await tmpDir.cleanup();
+    }
     logger.info('Finished repository');
   }
 }
diff --git a/test/manager/composer/lock-file.spec.js b/test/manager/composer/lock-file.spec.js
index 95d52b4cf919f252e4b5a563d976fe655768f749..14bd7d8bda868cfd164cdf12a019e8ecb73d7535 100644
--- a/test/manager/composer/lock-file.spec.js
+++ b/test/manager/composer/lock-file.spec.js
@@ -5,12 +5,18 @@ const fs = require('fs-extra');
 const { exec } = require('child-process-promise');
 const composer = require('../../../lib/manager/composer/lock-file');
 
+const config = {
+  localDir: '/tmp/github/some/repo',
+};
+
 describe('.getLockFile()', () => {
   beforeEach(() => {
     jest.resetAllMocks();
   });
   it('returns if no composer.lock found', async () => {
-    expect(await composer.getLockFile('composer.json', [], '{}')).toBeNull();
+    expect(
+      await composer.getLockFile('composer.json', [], '{}', config)
+    ).toBeNull();
   });
   it('returns null if unchanged', async () => {
     platform.getFile.mockReturnValueOnce('Current composer.lock');
@@ -19,7 +25,9 @@ describe('.getLockFile()', () => {
       stderror: '',
     });
     fs.readFile = jest.fn(() => 'Current composer.lock');
-    expect(await composer.getLockFile('composer.json', [], '{}')).toBeNull();
+    expect(
+      await composer.getLockFile('composer.json', [], '{}', config)
+    ).toBeNull();
   });
   it('returns updated composer.lock', async () => {
     platform.getFile.mockReturnValueOnce('Current composer.lock');
@@ -29,7 +37,7 @@ describe('.getLockFile()', () => {
     });
     fs.readFile = jest.fn(() => 'New composer.lock');
     expect(
-      await composer.getLockFile('composer.json', [], '{}')
+      await composer.getLockFile('composer.json', [], '{}', config)
     ).not.toBeNull();
   });
   it('catches errors', async () => {
@@ -37,6 +45,8 @@ describe('.getLockFile()', () => {
     fs.outputFile = jest.fn(() => {
       throw new Error('not found');
     });
-    expect(await composer.getLockFile('composer.json', [], '{}')).toBeNull();
+    expect(
+      await composer.getLockFile('composer.json', [], '{}', config)
+    ).toBeNull();
   });
 });