diff --git a/scripts/gcp-setup.sh b/scripts/gcp-setup.sh
index 0c88c08..7308437 100755
--- a/scripts/gcp-setup.sh
+++ b/scripts/gcp-setup.sh
@@ -102,6 +102,7 @@ echo "Granted objectViewer to $SA_EMAIL."
 echo ""
 echo "--- Step 9: Create and store service account key ---"
 KEY_FILE=$(mktemp)
+trap 'rm -f "$KEY_FILE"' EXIT
 $GCLOUD iam service-accounts keys create "$KEY_FILE" --iam-account="$SA_EMAIL"
 echo "Service account key created."
 
@@ -118,7 +119,6 @@ else
     --region "$AWS_REGION"
   echo "Created secret forgejo/gcs-sa-key."
 fi
-rm -f "$KEY_FILE"
 echo "Key stored in AWS Secrets Manager, local copy deleted."
 
 # --- Storage Transfer ---