diff --git a/dist/index.js b/dist/index.js
index 11cd8ec..be3e7b2 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -52495,6 +52495,13 @@ const cmdTailscaledFullPath = "/usr/local/bin/tailscaled";
 const runnerLinux = "Linux";
 const runnerWindows = "Windows";
 const runnerMacOS = "macOS";
+// XDG base directories with sensible defaults.
+function xdgCacheDir() {
+    return process.env.XDG_CACHE_HOME || path.join(os.homedir(), ".cache");
+}
+function xdgRuntimeDir() {
+    return process.env.XDG_RUNTIME_DIR || xdgCacheDir();
+}
 const versionLatest = "latest";
 const versionUnstable = "unstable";
 // Cross-platform Tailscale local API status check
@@ -52805,7 +52812,9 @@ async function installTailscaleLinux(config, toolPath) {
     // Download and extract
     const downloadUrl = `${baseUrl}/tailscale_${config.resolvedVersion}_${config.arch}.tgz`;
     core.info(`Downloading ${downloadUrl}`);
-    const tarPath = await tc.downloadTool(downloadUrl, "tailscale.tgz");
+    const tarDest = path.join(xdgCacheDir(), "tailscale.tgz");
+    fs.mkdirSync(path.dirname(tarDest), { recursive: true });
+    const tarPath = await tc.downloadTool(downloadUrl, tarDest);
     // Verify checksum
     const actualSha = await calculateFileSha256(tarPath);
     const expectedSha = config.sha256Sum.trim().toLowerCase();
@@ -52979,7 +52988,9 @@ async function startTailscaleDaemon(config) {
         ],
     });
     // Store PID for cleaning up daemon process in logout.ts.
-    fs.writeFileSync("tailscaled.pid", `${daemon.pid}`);
+    const pidFile = path.join(xdgRuntimeDir(), "tailscaled.pid");
+    fs.mkdirSync(path.dirname(pidFile), { recursive: true });
+    fs.writeFileSync(pidFile, `${daemon.pid}`);
     daemon.unref(); // Ensure daemon doesn't keep Node.js process alive
     // Close stdin/stdout/stderr to fully detach
     if (daemon.stdin)
diff --git a/dist/logout/index.js b/dist/logout/index.js
index bc97a6e..a98d9b6 100644
--- a/dist/logout/index.js
+++ b/dist/logout/index.js
@@ -25928,6 +25928,8 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 const core = __importStar(__nccwpck_require__(7484));
 const exec = __importStar(__nccwpck_require__(5236));
 const fs = __importStar(__nccwpck_require__(9896));
+const os = __importStar(__nccwpck_require__(857));
+const path = __importStar(__nccwpck_require__(6928));
 const runnerWindows = "Windows";
 const runnerMacOS = "macOS";
 async function logout() {
@@ -25978,7 +25980,12 @@ async function logout() {
                 await exec.exec("taskkill", ["/F", "/IM", "tailscale-ipn.exe"]);
             }
             else {
-                const pid = fs.readFileSync("tailscaled.pid").toString();
+                const xdgRuntimeDir = process.env.XDG_RUNTIME_DIR ||
+                    process.env.XDG_CACHE_HOME ||
+                    path.join(os.homedir(), ".cache");
+                const pid = fs
+                    .readFileSync(path.join(xdgRuntimeDir, "tailscaled.pid"))
+                    .toString();
                 if (pid === "") {
                     throw new Error("pid file empty");
                 }
diff --git a/package-lock.json b/package-lock.json
index d77ce77..e537fa7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -525,7 +525,6 @@
       "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz",
       "integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@octokit/auth-token": "^4.0.0",
         "@octokit/graphql": "^7.1.0",
@@ -865,7 +864,6 @@
       "integrity": "sha512-v6UNi1+3hSlVvv8fSaoUbggEM5VErKmmpGA7Pl3HF8V6uKY7rvClBOJlH6yNwQtfTueNkGVpOv/mtWL9L4bgRA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "prettier": "bin/prettier.cjs"
       },
@@ -938,7 +936,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
diff --git a/src/logout/logout.ts b/src/logout/logout.ts
index 57b3b65..ca07e62 100644
--- a/src/logout/logout.ts
+++ b/src/logout/logout.ts
@@ -4,6 +4,8 @@
 import * as core from "@actions/core";
 import * as exec from "@actions/exec";
 import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
 
 const runnerWindows = "Windows";
 const runnerMacOS = "macOS";
@@ -61,7 +63,13 @@ async function logout(): Promise<void> {
         await exec.exec("net", ["stop", "Tailscale"]);
         await exec.exec("taskkill", ["/F", "/IM", "tailscale-ipn.exe"]);
       } else {
-        const pid = fs.readFileSync("tailscaled.pid").toString();
+        const xdgRuntimeDir =
+          process.env.XDG_RUNTIME_DIR ||
+          process.env.XDG_CACHE_HOME ||
+          path.join(os.homedir(), ".cache");
+        const pid = fs
+          .readFileSync(path.join(xdgRuntimeDir, "tailscaled.pid"))
+          .toString();
         if (pid === "") {
           throw new Error("pid file empty");
         }
diff --git a/src/main.ts b/src/main.ts
index 4dd0cce..648b5b0 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -22,6 +22,15 @@ const runnerLinux = "Linux";
 const runnerWindows = "Windows";
 const runnerMacOS = "macOS";
 
+// XDG base directories with sensible defaults.
+function xdgCacheDir(): string {
+  return process.env.XDG_CACHE_HOME || path.join(os.homedir(), ".cache");
+}
+
+function xdgRuntimeDir(): string {
+  return process.env.XDG_RUNTIME_DIR || xdgCacheDir();
+}
+
 const versionLatest = "latest";
 const versionUnstable = "unstable";
 
@@ -420,7 +429,9 @@ async function installTailscaleLinux(
   const downloadUrl = `${baseUrl}/tailscale_${config.resolvedVersion}_${config.arch}.tgz`;
   core.info(`Downloading ${downloadUrl}`);
 
-  const tarPath = await tc.downloadTool(downloadUrl, "tailscale.tgz");
+  const tarDest = path.join(xdgCacheDir(), "tailscale.tgz");
+  fs.mkdirSync(path.dirname(tarDest), { recursive: true });
+  const tarPath = await tc.downloadTool(downloadUrl, tarDest);
 
   // Verify checksum
   const actualSha = await calculateFileSha256(tarPath);
@@ -651,7 +662,9 @@ async function startTailscaleDaemon(config: TailscaleConfig): Promise<void> {
   });
 
   // Store PID for cleaning up daemon process in logout.ts.
-  fs.writeFileSync("tailscaled.pid", `${daemon.pid}`);
+  const pidFile = path.join(xdgRuntimeDir(), "tailscaled.pid");
+  fs.mkdirSync(path.dirname(pidFile), { recursive: true });
+  fs.writeFileSync(pidFile, `${daemon.pid}`);
 
   daemon.unref(); // Ensure daemon doesn't keep Node.js process alive