diff --git a/lib/ip-reputation.sh b/lib/ip-reputation.sh
index bfa2ade..5a5fcbd 100644
--- a/lib/ip-reputation.sh
+++ b/lib/ip-reputation.sh
@@ -13,8 +13,8 @@
 # - Shared across all monitoring/analysis scripts
 ################################################################################
 
-# Database location
-IP_REP_DB_DIR="${IP_REP_DB_DIR:-/var/lib/server-toolkit/ip-reputation}"
+# Database location (uses /tmp - cleaned on reboot, no system pollution)
+IP_REP_DB_DIR="${IP_REP_DB_DIR:-/tmp/server-toolkit-reputation}"
 IP_REP_DB="$IP_REP_DB_DIR/ip_database.db"
 IP_REP_INDEX="$IP_REP_DB_DIR/ip_index.idx"
 IP_REP_LOCK="$IP_REP_DB_DIR/.db.lock"