diff --git a/src/Event/ExcludedPathsSubscriber.php b/src/Event/ExcludedPathsSubscriber.php
index f9d46efa45579db0237110be516fc5d1491fe109..673ca757ea107f34d5e716491f8059e1876fe067 100644
--- a/src/Event/ExcludedPathsSubscriber.php
+++ b/src/Event/ExcludedPathsSubscriber.php
@@ -60,6 +60,17 @@ class ExcludedPathsSubscriber implements EventSubscriberInterface {
     $this->streamWrapperManager = $stream_wrapper_manager;
   }
 
+  /**
+   * Reacts before staged updates are committed the active directory.
+   *
+   * @param \Drupal\automatic_updates\Event\PreCommitEvent $event
+   *   The event object.
+   */
+  public function preCommit(PreCommitEvent $event): void {
+    // Don't copy anything from the staging area's sites/default.
+    $event->excludePath('sites/default');
+  }
+
   /**
    * Reacts to the beginning of an update process.
    *
@@ -136,6 +147,7 @@ class ExcludedPathsSubscriber implements EventSubscriberInterface {
   public static function getSubscribedEvents() {
     return [
       AutomaticUpdatesEvents::PRE_START => 'preStart',
+      AutomaticUpdatesEvents::PRE_COMMIT => 'preCommit',
     ];
   }
 
diff --git a/src/Updater.php b/src/Updater.php
index b6f57d8e8398c28bb4cde37a3aa61fae89f1c079..c06bb42c21b2c158cb08bcceef72b52f544cd8fd 100644
--- a/src/Updater.php
+++ b/src/Updater.php
@@ -7,6 +7,7 @@ use Drupal\automatic_updates\Event\PreCommitEvent;
 use Drupal\automatic_updates\Event\PreStartEvent;
 use Drupal\automatic_updates\Event\UpdateEvent;
 use Drupal\automatic_updates\Exception\UpdateException;
+use Drupal\Component\FileSystem\FileSystem;
 use Drupal\Core\State\StateInterface;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\Core\StringTranslation\TranslationInterface;
@@ -129,7 +130,7 @@ class Updater {
    *   The absolute path for stage directory.
    */
   public function getStageDirectory(): string {
-    return realpath(static::getVendorDirectory() . '/..') . '/.automatic_updates_stage';
+    return FileSystem::getOsTemporaryDirectory() . '/.automatic_updates_stage';
   }
 
   /**
@@ -227,11 +228,12 @@ class Updater {
    * Commits the current update.
    */
   public function commit(): void {
-    $this->dispatchUpdateEvent(AutomaticUpdatesEvents::PRE_COMMIT);
+    /** @var \Drupal\automatic_updates\Event\PreCommitEvent $event */
+    $event = $this->dispatchUpdateEvent(AutomaticUpdatesEvents::PRE_COMMIT);
     // @todo Pass excluded paths into the committer once
     // https://github.com/php-tuf/composer-stager/pull/14 is in a tagged release
     // of Composer Stager.
-    $this->committer->commit($this->getStageDirectory(), static::getActiveDirectory());
+    $this->committer->commit($this->getStageDirectory(), static::getActiveDirectory(), $this->getExclusions($event));
   }
 
   /**