diff --git a/package.json b/package.json
index 1668505c..5c9900dc 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "@salesforce/kit": "^3.2.4",
     "@salesforce/plugin-info": "^3.4.93",
     "@salesforce/sf-plugins-core": "^12.2.4",
-    "@salesforce/source-deploy-retrieve": "^12.24.1",
+    "@salesforce/source-deploy-retrieve": "^12.24.3",
     "@salesforce/source-tracking": "^7.4.10",
     "@salesforce/ts-types": "^2.0.12",
     "ansis": "^3.17.0",
diff --git a/test/commands/deploy/metadata.nut.ts b/test/commands/deploy/metadata.nut.ts
index 0cff9407..c03aa40f 100644
--- a/test/commands/deploy/metadata.nut.ts
+++ b/test/commands/deploy/metadata.nut.ts
@@ -15,7 +15,26 @@
  */
 
 import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
+import { readdir } from 'node:fs/promises';
 import { SourceTestkit } from '@salesforce/source-testkit';
+import { expect } from 'chai';
+
+async function getAllFilePaths(dir: string): Promise<string[]> {
+  let filePaths: string[] = [];
+  const entries = await readdir(dir, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isFile()) {
+      filePaths.push(fullPath);
+    } else if (entry.isDirectory()) {
+      // eslint-disable-next-line no-await-in-loop
+      filePaths = filePaths.concat(await getAllFilePaths(fullPath));
+    }
+  }
+  return filePaths;
+}
 
 describe('deploy metadata NUTs', () => {
   let testkit: SourceTestkit;
@@ -40,9 +59,20 @@ describe('deploy metadata NUTs', () => {
 
   describe('--metadata flag', () => {
     it('should deploy ApexClass', async () => {
+      process.env.SF_MDAPI_TEMP_DIR = 'myTempDirectory';
       await testkit.modifyLocalGlobs(['force-app/main/default/classes/*.cls'], '// comment');
       await testkit.deploy({ args: '--metadata ApexClass' });
       await testkit.expect.filesToBeDeployed(['force-app/main/default/classes/*']);
+
+      // no illegal file paths should be generated when using SF_MDAPI_TEMP_DIR
+      // Users/william.ruemmele/projects/oss/plugin-deploy-retrieve/test_session_1761066173823d94ce455705e3fe5/dreamhouse-lwc/myTempDirectory/2025-10-21T17_03_52.245Z_deploy/metadata/package.xml
+      expect(
+        (await getAllFilePaths(join(testkit.projectDir, process.env.SF_MDAPI_TEMP_DIR))).every((path) =>
+          /[<>:"/\\|?*]/.test(path)
+        )
+      ).to.be.true;
+
+      delete process.env.SF_MDAPI_TEMP_DIR;
     });
 
     it('should deploy named ApexClass', async () => {
diff --git a/yarn.lock b/yarn.lock
index fff7aa21..59ec3142 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1684,10 +1684,10 @@
     cli-progress "^3.12.0"
     terminal-link "^3.0.0"
 
-"@salesforce/source-deploy-retrieve@^12.22.11", "@salesforce/source-deploy-retrieve@^12.24.0", "@salesforce/source-deploy-retrieve@^12.24.1":
-  version "12.24.2"
-  resolved "https://registry.yarnpkg.com/@salesforce/source-deploy-retrieve/-/source-deploy-retrieve-12.24.2.tgz#b76c1a4c986dcac6e14bbffe80ff7e4934135994"
-  integrity sha512-3erIjuoUXt9FNjOaOg8a9Vzmbk1keUvfqRwKg02pKu1Ad/oqZXg5uPPPehJb1vM1lE18c/8kP6vkQmS0hasqUw==
+"@salesforce/source-deploy-retrieve@^12.22.11", "@salesforce/source-deploy-retrieve@^12.24.0", "@salesforce/source-deploy-retrieve@^12.24.3":
+  version "12.24.3"
+  resolved "https://registry.yarnpkg.com/@salesforce/source-deploy-retrieve/-/source-deploy-retrieve-12.24.3.tgz#125be3a3e6d0d0f21068648ce4a2e4bb49ea57b6"
+  integrity sha512-MTpilWa+1mOqZUEmbE7K/vgHAT0FjGDv9L6vn7Cof3kRhk3RZprIjR6Sd9/x1WteI+hR5JAMCDbKT/WiWJcKYw==
   dependencies:
     "@salesforce/core" "^8.23.2"
     "@salesforce/kit" "^3.2.4"