diff --git a/conductor/tier2/opencode.json.fragment b/conductor/tier2/opencode.json.fragment
index 3594b3b6..68569558 100644
--- a/conductor/tier2/opencode.json.fragment
+++ b/conductor/tier2/opencode.json.fragment
@@ -48,6 +48,11 @@
       "*GetTempPath*": "deny",
       "*gettempdir*": "deny",
       "*mkstemp*": "deny",
+      "*C:/tmp*": "deny",
+      "*C:\\tmp*": "deny",
+      "*c:/tmp*": "deny",
+      "*c:\\tmp*": "deny",
+      "*/c/tmp*": "deny",
       "git push*": "deny",
       "git checkout*": "deny",
       "git restore*": "deny",
@@ -87,6 +92,11 @@
           "*GetTempPath*": "deny",
           "*gettempdir*": "deny",
           "*mkstemp*": "deny",
+          "*C:/tmp*": "deny",
+          "*C:\\tmp*": "deny",
+          "*c:/tmp*": "deny",
+          "*c:\\tmp*": "deny",
+          "*/c/tmp*": "deny",
           "git push*": "deny",
           "git checkout*": "deny",
           "git restore*": "deny",