diff --git a/packages/kbn-es/src/cluster.js b/packages/kbn-es/src/cluster.js
index 2c81035d5c25..665f80e3802e 100644
--- a/packages/kbn-es/src/cluster.js
+++ b/packages/kbn-es/src/cluster.js
@@ -278,6 +278,7 @@ exports.Cluster = class Cluster {
     this._process = execa(ES_BIN, args, {
       cwd: installPath,
       env: {
+        ...(installPath ? { ES_TMPDIR: path.resolve(installPath, 'ES_TMPDIR') } : {}),
         ...process.env,
         ...(options.bundledJDK ? { JAVA_HOME: '' } : {}),
         ...(options.esEnvVars || {}),
diff --git a/packages/kbn-es/src/install/archive.js b/packages/kbn-es/src/install/archive.js
index ba675ed6ac20..60c04d4aabca 100644
--- a/packages/kbn-es/src/install/archive.js
+++ b/packages/kbn-es/src/install/archive.js
@@ -65,6 +65,10 @@ exports.installArchive = async function installArchive(archive, options = {}) {
   await decompress(dest, installPath);
   log.info('extracted to %s', chalk.bold(installPath));
 
+  const tmpdir = path.resolve(installPath, 'ES_TMPDIR');
+  fs.mkdirSync(tmpdir, { recursive: true });
+  log.info('created %s', chalk.bold(tmpdir));
+
   if (license !== 'oss') {
     // starting in 6.3, security is disabled by default. Since we bootstrap
     // the keystore, we can enable security ourselves.