diff --git a/bin/omarchy-refresh-pacman b/bin/omarchy-refresh-pacman
index 80f3c356..b86fb209 100755
--- a/bin/omarchy-refresh-pacman
+++ b/bin/omarchy-refresh-pacman
@@ -31,8 +31,16 @@ if [[ $channel != "stable" && $channel != "rc" && $channel != "edge" ]]; then
 fi
 
 # Render the channel templates plus this machine's regional additions as the
-# caller, so root only copies finished files.
+# caller, so root only copies finished files. The scratch directory goes on
+# every exit, including a failed render, a refused sudo prompt, or a signal;
+# revoking the sudo timestamp stays the last thing the exit path does.
 rendered=$(mktemp -d)
+cleanup_refresh() {
+  local status=$?
+  rm -rf "$rendered"
+  omarchy_security_exit_with_revoked_sudo "$status"
+}
+trap cleanup_refresh EXIT
 "$OMARCHY_PATH/bin/omarchy-apply-pacman" --render "$channel" "$rendered"
 
 sudo cp -f /etc/pacman.conf /etc/pacman.conf.bak
diff --git a/test/shell.d/region-refresh-boundary-test.sh b/test/shell.d/region-refresh-boundary-test.sh
index b3b2f346..6ee3db8f 100755
--- a/test/shell.d/region-refresh-boundary-test.sh
+++ b/test/shell.d/region-refresh-boundary-test.sh
@@ -40,3 +40,24 @@ if grep -Eq '^(sudo -N cp |step:pacman )' "$SUDO_TEST_LOG"; then
   fail "invalid channel reached privileged work" "$(<"$SUDO_TEST_LOG")"
 fi
 pass "failed refresh does not proceed to privileged copies or a package update"
+
+# A failed render still removes its scratch directory and exits cold.
+reset_boundary
+mv "$SUDO_TEST_ROOT/bin/omarchy-apply-pacman" "$boundary_tmp/omarchy-apply-pacman"
+cat >"$SUDO_TEST_ROOT/bin/omarchy-apply-pacman" <<'STUB'
+#!/bin/bash
+: >"$3/pacman.conf"
+exit 1
+STUB
+chmod +x "$SUDO_TEST_ROOT/bin/omarchy-apply-pacman"
+mkdir -p "$boundary_tmp/scratch"
+if TMPDIR="$boundary_tmp/scratch" "$SUDO_TEST_ROOT/bin/omarchy-refresh-pacman" rc >"$boundary_tmp/output" 2>&1; then
+  fail "refresh succeeds after a failed render"
+fi
+mv "$boundary_tmp/omarchy-apply-pacman" "$SUDO_TEST_ROOT/bin/omarchy-apply-pacman"
+[[ -z $(ls -A "$boundary_tmp/scratch") ]] || fail "failed render leaves its scratch directory" "$(ls -AR "$boundary_tmp/scratch")"
+if grep -Eq '^(sudo -N cp |step:pacman )' "$SUDO_TEST_LOG"; then
+  fail "failed render reached privileged work" "$(<"$SUDO_TEST_LOG")"
+fi
+assert_boundary_cold "failed render"
+pass "failed render removes its scratch directory and exits cold"