diff --git a/backend/src/app/storage/s3.clj b/backend/src/app/storage/s3.clj
index 025749bee1..676660c95a 100644
--- a/backend/src/app/storage/s3.clj
+++ b/backend/src/app/storage/s3.clj
@@ -316,7 +316,7 @@
     ;; to the filesystem and then read with buffered inputstream; if
     ;; not, read the contento into memory using bytearrays.
     (if (> ^long size (* 1024 1024 2))
-      (let [path (tmp/tempfile :prefix "penpot.storage.s3." :min-age "6h")
+      (let [path (tmp/temp-path :prefix "penpot.storage.s3." :min-age "6h")
             rxf  (AsyncResponseTransformer/toFile ^Path path)]
         (->> (.getObject ^S3AsyncClient client
                          ^GetObjectRequest gor
diff --git a/backend/src/app/storage/tmp.clj b/backend/src/app/storage/tmp.clj
index b7a3076159..987ea4a1de 100644
--- a/backend/src/app/storage/tmp.clj
+++ b/backend/src/app/storage/tmp.clj
@@ -93,6 +93,25 @@
     (sp/offer! queue [path (some-> min-age ct/duration)])
     path))
 
+(defn temp-path
+  "Reserve a unique temp path WITHOUT creating the file.
+
+  Use it when an external writer needs to create the file itself and
+  fails if it already exists (like the S3 SDK file download, which
+  opens with CREATE_NEW). The path is still registered for cleanup,
+  so a crash between reserve and write does not leak."
+  [& {:keys [suffix prefix dir min-age]
+      :or {prefix "penpot."
+           suffix ".tmp"
+           dir    default-tmp-dir}}]
+  (fs/create-dir dir)
+  (loop [path (fs/join dir (str prefix (uuid/next) suffix))]
+    (if (fs/exists? path)
+      (recur (fs/join dir (str prefix (uuid/next) suffix)))
+      (do
+        (sp/offer! queue [path (some-> min-age ct/duration)])
+        path))))
+
 (defn tempfile-from
   "Create a new tempfile from from consuming the stream"
   [input & {:as options}]
diff --git a/backend/test/backend_tests/storage_tmp_test.clj b/backend/test/backend_tests/storage_tmp_test.clj
new file mode 100644
index 0000000000..b9141cf20b
--- /dev/null
+++ b/backend/test/backend_tests/storage_tmp_test.clj
@@ -0,0 +1,40 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
+
+(ns backend-tests.storage-tmp-test
+  (:require
+   [app.storage.tmp :as tmp]
+   [clojure.test :as t]
+   [datoteka.fs :as fs])
+  (:import
+   java.nio.file.Files
+   java.nio.file.Path))
+
+(t/deftest temp-path-does-not-create-the-file
+  (let [path (tmp/temp-path :prefix "penpot.test." :min-age "6h")]
+    (t/testing "the reserved path does not exist yet"
+      (t/is (not (fs/exists? path))))
+    (t/testing "an external writer can create it with CREATE_NEW"
+      (Files/createFile ^Path path (into-array java.nio.file.attribute.FileAttribute []))
+      (t/is (fs/exists? path)))
+    (fs/delete path)))
+
+(t/deftest temp-path-is-unique
+  (let [a (tmp/temp-path :prefix "penpot.test.")
+        b (tmp/temp-path :prefix "penpot.test.")]
+    (t/is (not= a b))
+    (t/is (not (fs/exists? a)))
+    (t/is (not (fs/exists? b)))))
+
+(t/deftest tempfile-creates-the-file-so-create-new-fails
+  (t/testing "documents why s3 downloads cannot use tempfile: the SDK opens with CREATE_NEW"
+    (let [path (tmp/tempfile :prefix "penpot.test.")]
+      (try
+        (t/is (fs/exists? path))
+        (t/is (thrown? java.nio.file.FileAlreadyExistsException
+                       (Files/createFile ^Path path (into-array java.nio.file.attribute.FileAttribute []))))
+        (finally
+          (fs/delete path))))))