diff --git a/features/package-install.feature b/features/package-install.feature
index 262e93d1..d8a5660e 100644
--- a/features/package-install.feature
+++ b/features/package-install.feature
@@ -1017,6 +1017,88 @@ Feature: Install WP-CLI packages
       wp-cli/google-sitemap-generator-cli
       """
 
+  Scenario: Install a package from a remote zip URL
+    Given an empty directory
+    And a remote-zip-test-command/composer.json file:
+      """
+      {
+        "name": "wp-cli-test/remote-zip-test-command",
+        "description": "Dummy package served over HTTP as a ZIP archive for acceptance tests.",
+        "type": "wp-cli-package"
+      }
+      """
+    And I run `php -r '$zip = new ZipArchive(); $zip->open( "remote-zip-test-command.zip", ZipArchive::CREATE | ZipArchive::OVERWRITE ); $zip->addFromString( "remote-zip-test-command/composer.json", file_get_contents( "remote-zip-test-command/composer.json" ) ); $zip->close();'`
+    And a PHP built-in web server
+
+    When I run `wp package install http://localhost:8080/remote-zip-test-command.zip`
+    Then STDOUT should contain:
+      """
+      Installing package wp-cli-test/remote-zip-test-command
+      """
+    And STDOUT should contain:
+      """
+      Success: Package installed.
+      """
+
+    When I run `wp package is-installed wp-cli-test/remote-zip-test-command`
+    Then the return code should be 0
+    And STDERR should be empty
+    And STDOUT should be empty
+
+  Scenario: Install a package from a remote zip URL with files at archive root
+    Given an empty directory
+    And a composer-flat.json file:
+      """
+      {
+        "name": "wp-cli-test/remote-zip-flat-command",
+        "description": "Dummy flat-layout ZIP package for acceptance tests.",
+        "type": "wp-cli-package"
+      }
+      """
+    And I run `php -r '$zip = new ZipArchive(); $zip->open( "remote-zip-flat-command.zip", ZipArchive::CREATE | ZipArchive::OVERWRITE ); $zip->addFromString( "composer.json", file_get_contents( "composer-flat.json" ) ); $zip->close();'`
+    And a PHP built-in web server
+
+    When I run `wp package install http://localhost:8080/remote-zip-flat-command.zip`
+    Then STDOUT should contain:
+      """
+      Installing package wp-cli-test/remote-zip-flat-command
+      """
+    And STDOUT should contain:
+      """
+      Success: Package installed.
+      """
+
+    When I run `wp package is-installed wp-cli-test/remote-zip-flat-command`
+    Then the return code should be 0
+    And STDERR should be empty
+    And STDOUT should be empty
+
+  Scenario: Install from a remote zip URL with invalid zip contents
+    Given an empty directory
+    And an invalid.zip file:
+      """
+      this is not a zip archive
+      """
+    And a PHP built-in web server
+
+    When I try `wp package install http://localhost:8080/invalid.zip`
+    Then the return code should be 1
+    And STDERR should contain:
+      """
+      ZipArchive failed to unzip
+      """
+
+  Scenario: Install from a remote zip URL that returns 404
+    Given an empty directory
+    And a PHP built-in web server
+
+    When I try `wp package install http://localhost:8080/missing.zip`
+    Then the return code should be 1
+    And STDERR should contain:
+      """
+      Couldn't download package from 'http://localhost:8080/missing.zip' (HTTP code 404).
+      """
+
   @github-api
   Scenario: Install a package from Git using a shortened mixed-case package identifier but lowercase composer.json name
     Given an empty directory
diff --git a/src/Package_Command.php b/src/Package_Command.php
index 81621306..0d08d832 100644
--- a/src/Package_Command.php
+++ b/src/Package_Command.php
@@ -276,7 +276,7 @@ public function install( $args, $assoc_args ) {
 			// Download the remote ZIP file to a temp directory
 			$temp = false;
 			if ( false !== strpos( $package_name, '://' ) ) {
-				$temp         = Utils\get_temp_dir() . uniqid( 'wp-cli-package_', true /*more_entropy*/ ) . '.zip';
+				$temp         = Utils\make_temp_file( 'wp-cli-package_', '.zip' );
 				$options      = [
 					'timeout'  => 600,
 					'filename' => $temp,
@@ -291,7 +291,7 @@ public function install( $args, $assoc_args ) {
 				}
 				$package_name = $temp;
 			}
-			$dir_package = Utils\get_temp_dir() . uniqid( 'wp-cli-package_', true /*more_entropy*/ );
+			$dir_package = Utils\make_temp_dir( 'wp-cli-package_' );
 			try {
 				// Extract the package to get the package name
 				Extractor::extract( $package_name, $dir_package );