diff --git a/nixos/modules/services/web-apps/homebox.nix b/nixos/modules/services/web-apps/homebox.nix
index 86d5a22a9326..54232535e8e4 100644
--- a/nixos/modules/services/web-apps/homebox.nix
+++ b/nixos/modules/services/web-apps/homebox.nix
@@ -43,7 +43,7 @@ in
       type = types.submodule { freeformType = types.attrsOf (types.nullOr types.str); };
       defaultText = lib.literalExpression ''
         {
-          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox?no_tmp_dir=1";
           HBOX_STORAGE_PREFIX_PATH = "data";
           HBOX_DATABASE_DRIVER = "sqlite3";
           HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
@@ -51,7 +51,6 @@ in
           HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
           HBOX_MODE = "production";
           HOME = "/var/lib/homebox";
-          TMPDIR = "/var/lib/homebox/tmp";
         }
       '';
       description = ''
@@ -125,7 +124,9 @@ in
 
     services.homebox.settings = lib.mkMerge [
       (lib.mapAttrs (_: mkDefault) {
-        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+        # We cannot use a tempdir as homebox wants to rename the file, which does not work across filesystem boundaries
+        # also see: https://github.com/google/go-cloud/issues/3294 and https://pkg.go.dev/gocloud.dev/blob/fileblob#URLOpener
+        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox?no_tmp_dir=1";
         HBOX_STORAGE_PREFIX_PATH = "data";
         HBOX_DATABASE_DRIVER = "sqlite3";
         HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
@@ -134,10 +135,8 @@ in
         HBOX_MODE = "production";
         # Fix this startup issue:
         #   failed to create modcache index dir: mkdir /var/empty/.cache: read-only file system
+        # TODO: remove once https://github.com/golang/tools/commit/03cb4551c662c0e078502fe5f317ca4114b89cd8 is available
         HOME = "/var/lib/homebox";
-        # Fix uploading/saving attachments/images:
-        # [...] rename /tmp/ced4804c80b1ed1f6e88060f6d829db421e6dbf3a189715265900b5d6b0243ed.1889b3d16ab36e22.tmp /var/lib/homebox/data/5f42f81b-e9ad-4495-b6a6-9e9f704db30e/documents/ced4804c80b1ed1f6e88060f6d829db421e6dbf3a189715265900b5d6b0243ed: invalid cross-device link" [...]
-        TMPDIR = "/var/lib/homebox/tmp";
       })
 
       (mkIf cfg.database.createLocally {
diff --git a/nixos/tests/homebox.nix b/nixos/tests/homebox.nix
index 5842668479e0..1d086305d8ab 100644
--- a/nixos/tests/homebox.nix
+++ b/nixos/tests/homebox.nix
@@ -14,6 +14,8 @@ in
           services.homebox = {
             enable = true;
             settings.HBOX_WEB_PORT = port;
+            settings.HBOX_OPTIONS_ALLOW_REGISTRATION = "true";
+            settings.HBOX_LOG_LEVEL = "trace";
           };
         };
 
@@ -50,6 +52,7 @@ in
     in
     self;
   testScript = ''
+    import json
     def test_homebox(node):
       node.wait_for_unit("homebox.service")
       node.wait_for_open_port(${port})
@@ -57,6 +60,29 @@ in
       node.succeed("curl --fail -X GET 'http://localhost:${port}/'")
       out = node.succeed("curl --fail 'http://localhost:${port}/api/v1/status'")
       assert '"health":true' in out
+      node.succeed("curl --request POST --fail 'http://localhost:${port}/api/v1/users/register' \
+        --data '{\"email\":\"a@b.c\",\"name\":\"test\",\"password\":\"password\"}' \
+      ")
+      login = node.succeed("curl --request POST --fail 'http://localhost:${port}/api/v1/users/login' \
+        --data-urlencode 'password=password' \
+        --data-urlencode 'username=a@b.c' \
+      ")
+      login_data = json.loads(login)
+      token = login_data["token"]
+      locations = node.succeed(f"curl --request GET --fail 'http://localhost:${port}/api/v1/entities?isLocation=true' \
+        --header 'Authorization: {token}' \
+      ")
+      location_id = json.loads(locations)["items"][0]["id"]
+      item = node.succeed(f"curl --request POST --fail 'http://localhost:${port}/api/v1/entities' \
+        --header 'Authorization: {token}' \
+        --data '{{\"name\":\"testitem\",\"parentId\":\"{location_id}\"}}' \
+      ")
+      item_id = json.loads(item)["id"]
+      node.succeed(f"curl --request POST --fail 'http://localhost:${port}/api/v1/entities/{item_id}/attachments' \
+        --header 'Authorization: {token}' \
+        --form 'file=test;type=text/plain;filename=test.txt' \
+        --form name=test.txt \
+      ")
 
     test_homebox(simple)
     simple.send_monitor_command("quit")