diff --git a/pkg/csplugin/broker_suite_test.go b/pkg/csplugin/broker_suite_test.go
index 1210c6705..768c0acd0 100644
--- a/pkg/csplugin/broker_suite_test.go
+++ b/pkg/csplugin/broker_suite_test.go
@@ -28,6 +28,7 @@ type PluginSuite struct {
 	notifDir     string // (config_paths.notification_dir)
 	pluginBinary string // full path to the plugin binary (unique for each test)
 	pluginConfig string // full path to the notification config (unique for each test)
+	outFile      string // full path to the output file (unique for each test)
 
 	pluginBroker *PluginBroker
 }
@@ -125,6 +126,9 @@ func (s *PluginSuite) SetupSubTest() {
 	s.pluginConfig = filepath.Join(s.notifDir, "dummy.yaml")
 	err = copyFile("testdata/dummy.yaml", s.pluginConfig)
 	require.NoError(t, err, "while copying plugin config")
+
+	s.outFile = filepath.Join(t.TempDir(), "out")
+	t.Setenv("OUTFILE", s.outFile)
 }
 
 func (s *PluginSuite) TearDownSubTest() {
@@ -139,8 +143,6 @@ func (s *PluginSuite) TearDownSubTest() {
 	if runtime.GOOS != "windows" {
 		require.NoError(t, err)
 	}
-
-	os.Remove("./out")
 }
 
 func (s *PluginSuite) InitBroker(ctx context.Context, procCfg *csconfig.PluginCfg) (*PluginBroker, error) {
diff --git a/pkg/csplugin/broker_test.go b/pkg/csplugin/broker_test.go
index 63ba65d2d..3da37b426 100644
--- a/pkg/csplugin/broker_test.go
+++ b/pkg/csplugin/broker_test.go
@@ -163,7 +163,7 @@ func (s *PluginSuite) TestBrokerNoThreshold() {
 	time.Sleep(200 * time.Millisecond)
 
 	// we expect one now
-	content, err := os.ReadFile("./out")
+	content, err := os.ReadFile(s.outFile)
 	require.NoError(t, err, "Error reading file")
 
 	err = json.Unmarshal(content, &alerts)
@@ -171,7 +171,7 @@ func (s *PluginSuite) TestBrokerNoThreshold() {
 	assert.Len(t, alerts, 1)
 
 	// remove it
-	os.Remove("./out")
+	os.Remove(s.outFile)
 
 	// and another one
 	log.Printf("second send")
@@ -180,7 +180,7 @@ func (s *PluginSuite) TestBrokerNoThreshold() {
 	time.Sleep(200 * time.Millisecond)
 
 	// we expect one again, as we cleaned the file
-	content, err = os.ReadFile("./out")
+	content, err = os.ReadFile(s.outFile)
 	require.NoError(t, err, "Error reading file")
 
 	err = json.Unmarshal(content, &alerts)
@@ -216,10 +216,10 @@ func (s *PluginSuite) TestBrokerRunGroupAndTimeThreshold_TimeFirst() {
 
 	time.Sleep(500 * time.Millisecond)
 	// because of group threshold, we shouldn't have data yet
-	assert.NoFileExists(t, "./out")
+	assert.NoFileExists(t, s.outFile)
 	time.Sleep(1 * time.Second)
 	// after 1 seconds, we should have data
-	content, err := os.ReadFile("./out")
+	content, err := os.ReadFile(s.outFile)
 	require.NoError(t, err)
 
 	var alerts []models.Alert
@@ -254,13 +254,13 @@ func (s *PluginSuite) TestBrokerRunGroupAndTimeThreshold_CountFirst() {
 	time.Sleep(100 * time.Millisecond)
 
 	// because of group threshold, we shouldn't have data yet
-	assert.NoFileExists(t, "./out")
+	assert.NoFileExists(t, s.outFile)
 	pb.PluginChannel <- ProfileAlert{ProfileID: uint(0), Alert: &models.Alert{}}
 
 	time.Sleep(100 * time.Millisecond)
 
 	// and now we should
-	content, err := os.ReadFile("./out")
+	content, err := os.ReadFile(s.outFile)
 	require.NoError(t, err, "Error reading file")
 
 	var alerts []models.Alert
@@ -295,7 +295,7 @@ func (s *PluginSuite) TestBrokerRunGroupThreshold() {
 	time.Sleep(time.Second)
 
 	// because of group threshold, we shouldn't have data yet
-	assert.NoFileExists(t, "./out")
+	assert.NoFileExists(t, s.outFile)
 	pb.PluginChannel <- ProfileAlert{ProfileID: uint(0), Alert: &models.Alert{}}
 	pb.PluginChannel <- ProfileAlert{ProfileID: uint(0), Alert: &models.Alert{}}
 	pb.PluginChannel <- ProfileAlert{ProfileID: uint(0), Alert: &models.Alert{}}
@@ -303,7 +303,7 @@ func (s *PluginSuite) TestBrokerRunGroupThreshold() {
 	time.Sleep(time.Second)
 
 	// and now we should
-	content, err := os.ReadFile("./out")
+	content, err := os.ReadFile(s.outFile)
 	require.NoError(t, err, "Error reading file")
 
 	decoder := json.NewDecoder(bytes.NewReader(content))
@@ -347,11 +347,11 @@ func (s *PluginSuite) TestBrokerRunTimeThreshold() {
 	time.Sleep(200 * time.Millisecond)
 
 	// we shouldn't have data yet
-	assert.NoFileExists(t, "./out")
+	assert.NoFileExists(t, s.outFile)
 	time.Sleep(1 * time.Second)
 
 	// and now we should
-	content, err := os.ReadFile("./out")
+	content, err := os.ReadFile(s.outFile)
 	require.NoError(t, err, "Error reading file")
 
 	var alerts []models.Alert
@@ -372,16 +372,16 @@ func (s *PluginSuite) TestBrokerRunSimple() {
 	tomb := tomb.Tomb{}
 	go pb.Run(&tomb)
 
-	assert.NoFileExists(t, "./out")
+	assert.NoFileExists(t, s.outFile)
 
-	defer os.Remove("./out")
+	defer os.Remove(s.outFile)
 
 	pb.PluginChannel <- ProfileAlert{ProfileID: uint(0), Alert: &models.Alert{}}
 	pb.PluginChannel <- ProfileAlert{ProfileID: uint(0), Alert: &models.Alert{}}
 	// make it wait a bit, CI can be slow
 	time.Sleep(time.Second)
 
-	content, err := os.ReadFile("./out")
+	content, err := os.ReadFile(s.outFile)
 	require.NoError(t, err, "Error reading file")
 
 	decoder := json.NewDecoder(bytes.NewReader(content))
diff --git a/pkg/csplugin/broker_win_test.go b/pkg/csplugin/broker_win_test.go
index e28056ae6..e7ea584b0 100644
--- a/pkg/csplugin/broker_win_test.go
+++ b/pkg/csplugin/broker_win_test.go
@@ -76,16 +76,16 @@ func (s *PluginSuite) TestBrokerRun() {
 	tomb := tomb.Tomb{}
 	go pb.Run(&tomb)
 
-	assert.NoFileExists(t, "./out")
-	defer os.Remove("./out")
+	assert.NoFileExists(t, s.outFile)
+	defer os.Remove(s.outFile)
 
 	pb.PluginChannel <- ProfileAlert{ProfileID: uint(0), Alert: &models.Alert{}}
 	pb.PluginChannel <- ProfileAlert{ProfileID: uint(0), Alert: &models.Alert{}}
 	time.Sleep(time.Second * 4)
 
-	assert.FileExists(t, ".\\out")
+	assert.FileExists(t, s.outFile)
 
-	content, err := os.ReadFile("./out")
+	content, err := os.ReadFile(s.outFile)
 	require.NoError(t, err, "Error reading file")
 
 	decoder := json.NewDecoder(bytes.NewReader(content))
diff --git a/pkg/csplugin/testdata/dummy.yaml b/pkg/csplugin/testdata/dummy.yaml
index 1b883af4b..5f50e7c6c 100644
--- a/pkg/csplugin/testdata/dummy.yaml
+++ b/pkg/csplugin/testdata/dummy.yaml
@@ -18,5 +18,5 @@ format: |
   {{.|toJson}}
 
 #
-output_file: ./out        # notifications will be appended here. optional
+output_file: ${OUTFILE}