diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index e4bd0da16..429a7ab9c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -110,7 +110,7 @@ jobs:
           printf '%s/%s/actions/runs/%s/attempts/%s\n'\
             "${GITHUB_SERVER_URL}" "${GITHUB_REPOSITORY}" "${GITHUB_RUN_ID}" "${GITHUB_RUN_ATTEMPT}"\
             > ~/ok-by-run
-          find . -name .git -prune -o -name testdata -prune -o -name go.mod -printf '%h\n' |
+          find . -name .git -prune -o -name testdata -prune -o -name go.mod -print | xargs -n1 dirname |
           while read -r dir; do (
             cd "$dir"
             go list -m
@@ -133,3 +133,22 @@ jobs:
           sudo journalctl --unit postgresql.service --boot -0
           ls /var/log/postgresql/postgresql-*.log
           sudo cat /var/log/postgresql/postgresql-*.log
+
+  platform-tests:
+    name: Platform Tests
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+      - name: Test Fetcher
+        run: go test -race -v -run TestFetch ./libindex/
diff --git a/libindex/reopen_other.go b/libindex/reopen_other.go
index 71334f71c..538bc7153 100644
--- a/libindex/reopen_other.go
+++ b/libindex/reopen_other.go
@@ -2,8 +2,11 @@
 
 package libindex
 
-import "os"
+import (
+	"os"
+	"path/filepath"
+)
 
 func reopen(dir *os.Root, f *os.File) (*os.File, error) {
-	return dir.OpenFile(f.Name(), os.O_RDONLY, 0o644)
+	return dir.OpenFile(filepath.Base(f.Name()), os.O_RDONLY, 0o644)
 }
diff --git a/libindex/tempfile_linux.go b/libindex/tempfile_linux.go
index fab396bfe..dc2ba0db4 100644
--- a/libindex/tempfile_linux.go
+++ b/libindex/tempfile_linux.go
@@ -46,6 +46,7 @@ Loop:
 		flag := os.O_WRONLY
 		if !tmpOK {
 			name = fetchFilename()
+			flag |= os.O_CREATE | os.O_EXCL // Create new file, fail if exists
 		} else {
 			flag |= unix.O_TMPFILE
 		}
diff --git a/libindex/tempfile_unix.go b/libindex/tempfile_unix.go
index f3b75d733..0e1cc078b 100644
--- a/libindex/tempfile_unix.go
+++ b/libindex/tempfile_unix.go
@@ -10,7 +10,7 @@ import (
 )
 
 func openTemp(dir *os.Root) (f *os.File, err error) {
-	const flag = os.O_WRONLY
+	const flag = os.O_WRONLY | os.O_CREATE | os.O_EXCL
 	for {
 		name := fetchFilename()
 		f, err = dir.OpenFile(name, flag, 0o644)
diff --git a/libindex/tempfile_windows.go b/libindex/tempfile_windows.go
index 790242046..6b5df3d99 100644
--- a/libindex/tempfile_windows.go
+++ b/libindex/tempfile_windows.go
@@ -12,7 +12,7 @@ import (
 func openTemp(dir *os.Root) (f *os.File, err error) {
 	// Copied out of golang.org/x/sys/windows
 	const FILE_FLAG_DELETE_ON_CLOSE = 0x04000000
-	const flag = os.O_WRONLY | FILE_FLAG_DELETE_ON_CLOSE
+	const flag = os.O_WRONLY | os.O_CREATE | os.O_EXCL | FILE_FLAG_DELETE_ON_CLOSE
 	for {
 		name := fetchFilename()
 		f, err = dir.OpenFile(name, flag, 0o644)