diff --git a/scripts/gcp-setup.sh b/scripts/gcp-setup.sh
index 0c88c08..d55e32b 100755
--- a/scripts/gcp-setup.sh
+++ b/scripts/gcp-setup.sh
@@ -102,6 +102,7 @@ echo "Granted objectViewer to $SA_EMAIL."
 echo ""
 echo "--- Step 9: Create and store service account key ---"
 KEY_FILE=$(mktemp)
+trap 'rm -f "$KEY_FILE"' EXIT
 $GCLOUD iam service-accounts keys create "$KEY_FILE" --iam-account="$SA_EMAIL"
 echo "Service account key created."