diff --git a/internal/pkg/tar.go b/internal/pkg/tar.go
index 0d1c572..5444aab 100644
--- a/internal/pkg/tar.go
+++ b/internal/pkg/tar.go
@@ -11,6 +11,7 @@ import (
 	"io/fs"
 	"net/http"
 	"os"
+	"path"
 
 	"hakurei.app/container/check"
 )
@@ -128,9 +129,14 @@ func (a *tarArtifact) Cure(c *CureContext) (err error) {
 				continue
 
 			case tar.TypeReg:
+				p := temp.Append(header.Name).String()
+				if err = os.MkdirAll(path.Dir(p), 0700); err != nil {
+					return
+				}
+
 				var f *os.File
 				if f, err = os.OpenFile(
-					temp.Append(header.Name).String(),
+					p,
 					os.O_CREATE|os.O_EXCL|os.O_WRONLY,
 					header.FileInfo().Mode()&0400,
 				); err != nil {
@@ -145,19 +151,21 @@ func (a *tarArtifact) Cure(c *CureContext) (err error) {
 				break
 
 			case tar.TypeLink:
-				if err = os.Link(
-					header.Linkname,
-					temp.Append(header.Name).String(),
-				); err != nil {
+				p := temp.Append(header.Name).String()
+				if err = os.MkdirAll(path.Dir(p), 0700); err != nil {
+					return
+				}
+				if err = os.Link(header.Linkname, p); err != nil {
 					return
 				}
 				break
 
 			case tar.TypeSymlink:
-				if err = os.Symlink(
-					header.Linkname,
-					temp.Append(header.Name).String(),
-				); err != nil {
+				p := temp.Append(header.Name).String()
+				if err = os.MkdirAll(path.Dir(p), 0700); err != nil {
+					return
+				}
+				if err = os.Symlink(header.Linkname, p); err != nil {
 					return
 				}
 				break