diff --git a/manifests/swh/deploy/worker/instance.pp b/manifests/swh/deploy/worker/instance.pp
index d296d5d..9f1ba45 100644
--- a/manifests/swh/deploy/worker/instance.pp
+++ b/manifests/swh/deploy/worker/instance.pp
@@ -1,117 +1,117 @@
 # Instance of a worker
 define profile::swh::deploy::worker::instance (
   $ensure = present,
   $task_broker = '',
   $task_modules = [],
   $task_queues = [],
   $task_soft_time_limit = 0,
   $concurrency = 10,
   $loglevel = 'info',
   $max_tasks_per_child = 5,
   $instance_name = $title,
   $limit_no_file = undef,
-  $private_tmp = 'None')
+  $private_tmp = undef)
 {
   include ::profile::swh::deploy::worker::base
   include ::systemd
 
   $service_basename = "swh-worker@${instance_name}"
   $service_name = "${service_basename}.service"
   $systemd_dir = "/etc/systemd/system/${service_name}.d"
   $systemd_snippet = "${systemd_dir}/parameters.conf"
   $config_directory = '/etc/softwareheritage/worker'
   $instance_config = "${config_directory}/${instance_name}.ini"
 
   case $ensure {
     'present': {
       file {$systemd_dir:
         ensure => directory,
         owner  => 'root',
         group  => 'root',
         mode   => '0755',
       }
 
       # Uses variables
       # - $concurrency
       # - $loglevel
       # - $max_tasks_per_child
       file {$systemd_snippet:
         ensure  => present,
         owner   => 'root',
         group   => 'root',
         mode    => '0644',
         content => template('profile/swh/deploy/worker/parameters.conf.erb'),
         notify  => [
           Exec['systemd-daemon-reload'],
         ],
       }
 
       # Uses variables
       # - $task_broker
       # - $task_modules
       # - $task_queues
       # - $task_soft_time_limit
       file {$instance_config:
         ensure  => present,
         owner   => 'swhworker',
         group   => 'swhdev',
         # contains a password for the broker
         mode    => '0640',
         content => template('profile/swh/deploy/worker/instance_config.ini.erb'),
       }
     }
     'running': {
       file {$systemd_dir:
         ensure => directory,
         owner  => 'root',
         group  => 'root',
         mode   => '0755',
       }
 
       # Uses variables
       # - $concurrency
       # - $loglevel
       # - $max_tasks_per_child
       file {$systemd_snippet:
         ensure  => present,
         owner   => 'root',
         group   => 'root',
         mode    => '0644',
         content => template('profile/swh/deploy/worker/parameters.conf.erb'),
         notify  => [
           Exec['systemd-daemon-reload'],
         ],
       }
 
       # Uses variables
       # - $task_broker
       # - $task_modules
       # - $task_queues
       # - $task_soft_time_limit
       file {$instance_config:
         ensure  => present,
         owner   => 'swhworker',
         group   => 'swhdev',
         # contains a password for the broker
         mode    => '0640',
         content => template('profile/swh/deploy/worker/instance_config.ini.erb'),
       }
 
       service {$service_basename:
         ensure  => running,
         require => [
           File[$instance_config],
           File[$systemd_snippet],
         ],
       }
     }
     default: {
       file {[
         $systemd_dir,
         $instance_config,
       ]:
         ensure => absent,
       }
     }
   }
 }
diff --git a/manifests/swh/deploy/worker/swh_loader_mercurial.pp b/manifests/swh/deploy/worker/swh_loader_mercurial.pp
index c77c8f5..6737a45 100644
--- a/manifests/swh/deploy/worker/swh_loader_mercurial.pp
+++ b/manifests/swh/deploy/worker/swh_loader_mercurial.pp
@@ -1,43 +1,45 @@
 # Deployment for swh-loader-mercurial (disk)
 class profile::swh::deploy::worker::swh_loader_mercurial {
   include ::profile::swh::deploy::base_loader_git
 
   $concurrency = hiera('swh::deploy::worker::swh_loader_mercurial::concurrency')
   $loglevel = hiera('swh::deploy::worker::swh_loader_mercurial::loglevel')
   $task_broker = hiera('swh::deploy::worker::swh_loader_mercurial::task_broker')
 
   $config_file = '/etc/softwareheritage/loader/hg.yml'
   $config = hiera('swh::deploy::worker::swh_loader_mercurial::config')
 
   $task_modules = ['swh.loader.mercurial.tasks']
   $task_queues = ['swh_loader_mercurial', 'swh_loader_mercurial_archive']
 
   $service_name = 'swh_loader_mercurial'
+  $private_tmp = hiera('swh::deploy::worker::swh_loader_mercurial::private_tmp')
 
   $packages = ['python3-swh.loader.mercurial']
 
   package {$packages:
     ensure => 'latest',
     notify => Service["swh-worker@$service_name"]
   }
 
   ::profile::swh::deploy::worker::instance {$service_name:
     ensure       => running,
     concurrency  => $concurrency,
     loglevel     => $loglevel,
     task_broker  => $task_broker,
     task_modules => $task_modules,
     task_queues  => $task_queues,
+    private_tmp  => $private_tmp,
     require      => [
       File[$config_file],
     ],
   }
 
   file {$config_file:
     ensure  => 'present',
     owner   => 'swhworker',
     group   => 'swhworker',
     mode    => '0644',
     content => inline_template("<%= @config.to_yaml %>\n"),
   }
 }
diff --git a/manifests/swh/deploy/worker/swh_loader_svn.pp b/manifests/swh/deploy/worker/swh_loader_svn.pp
index dc6f3b6..c988e41 100644
--- a/manifests/swh/deploy/worker/swh_loader_svn.pp
+++ b/manifests/swh/deploy/worker/swh_loader_svn.pp
@@ -1,41 +1,43 @@
 # Deployment for swh-loader-svn
 class profile::swh::deploy::worker::swh_loader_svn {
   $concurrency = hiera('swh::deploy::worker::swh_loader_svn::concurrency')
   $loglevel = hiera('swh::deploy::worker::swh_loader_svn::loglevel')
   $task_broker = hiera('swh::deploy::worker::swh_loader_svn::task_broker')
 
   $config_file = '/etc/softwareheritage/loader/svn.yml'
   $config = hiera('swh::deploy::worker::swh_loader_svn::config')
 
   $task_modules = ['swh.loader.svn.tasks']
   $task_queues = ['swh_loader_svn', 'swh_loader_svn_mount_and_load']
 
   $packages = ['python3-swh.loader.svn']
   $limit_no_file = hiera('swh::deploy::worker::swh_loader_svn::limit_no_file')
+  $private_tmp = hiera('swh::deploy::worker::swh_loader_svn::private_tmp')
 
   package {$packages:
     ensure => 'latest',
   }
 
   ::profile::swh::deploy::worker::instance {'swh_loader_svn':
     ensure        => present,
     concurrency   => $concurrency,
     loglevel      => $loglevel,
     task_broker   => $task_broker,
     task_modules  => $task_modules,
     task_queues   => $task_queues,
     limit_no_file => $limit_no_file,
+    private_tmp   => $private_tmp,
     require       => [
       Package[$packages],
       File[$config_file],
     ],
   }
 
   file {$config_file:
     ensure  => 'present',
     owner   => 'swhworker',
     group   => 'swhworker',
     mode    => '0644',
     content => inline_template("<%= @config.to_yaml %>\n"),
   }
 }
diff --git a/templates/swh/deploy/worker/parameters.conf.erb b/templates/swh/deploy/worker/parameters.conf.erb
index 7f79a0f..5c9c289 100644
--- a/templates/swh/deploy/worker/parameters.conf.erb
+++ b/templates/swh/deploy/worker/parameters.conf.erb
@@ -1,10 +1,13 @@
 # Managed by puppet - modifications will be overwritten
 # In defined class profile::swh::deploy::worker::instance
 
 [Service]
 Environment=CONCURRENCY=<%= @concurrency %>
 Environment=MAX_TASKS_PER_CHILD=<%= @max_tasks_per_child %>
 Environment=LOGLEVEL=<%= @loglevel %>
 <% if @limit_no_file %>
 LimitNOFILE=<%= @limit_no_file %>
 <% end %>
+<% if @private_tmp %>
+TmpPrivate=<%= @private_tmp %>
+<% end %>