diff --git a/pkgs/applications/networking/browsers/firefox-bin/update.nix b/pkgs/applications/networking/browsers/firefox-bin/update.nix
index 13725c44aca8..99bae86a4ae1 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/update.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/update.nix
@@ -24,7 +24,7 @@ in writeScript "update-${name}" ''
   set -eux
   pushd ${basePath}
 
-  HOME=`mktemp -d`
+  export GNUPGHOME=`mktemp -d`
   gpg --keyserver hkps://gpg.mozilla.org --recv-keys 14F26682D0916CDD81E37B6D61B7B526D98F0353
 
   tmpfile=`mktemp`
@@ -50,7 +50,7 @@ in writeScript "update-${name}" ''
 
   curl --silent -o $HOME/shasums "$url$version/SHA512SUMS"
   curl --silent -o $HOME/shasums.asc "$url$version/SHA512SUMS.asc"
-  gpgv --keyring=$HOME/.gnupg/pubring.kbx $HOME/shasums.asc $HOME/shasums
+  gpgv --keyring=$GNUPGHOME/pubring.kbx $HOME/shasums.asc $HOME/shasums
 
   # this is a list of sha512 and tarballs for both arches
   shasums=`cat $HOME/shasums`