diff --git a/internal/plugin/installer/oci_installer.go b/internal/plugin/installer/oci_installer.go
index a67857a71..675fbde8c 100644
--- a/internal/plugin/installer/oci_installer.go
+++ b/internal/plugin/installer/oci_installer.go
@@ -209,24 +209,24 @@ func extractTarGz(r io.Reader, targetDir string) error {
 	return extractTar(gzr, targetDir)
 }
 
-// extractFile creates a single file from the tar archive
+// extractFile creates a single file from the tar archive.
 func extractFile(path string, mode int64, src io.Reader) error {
 	dir := filepath.Dir(path)
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		return err
 	}
 
-	outFile, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, os.FileMode(mode))
+	outFile, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, os.FileMode(mode))
 	if err != nil {
 		return err
 	}
-	defer outFile.Close()
 
 	if _, err := io.Copy(outFile, src); err != nil {
+		outFile.Close()
 		return err
 	}
 
-	return nil
+	return outFile.Close()
 }
 
 // extractTar extracts a tar archive to a directory
diff --git a/internal/plugin/installer/oci_installer_unix_test.go b/internal/plugin/installer/oci_installer_unix_test.go
index 74614fe63..7fb9876da 100644
--- a/internal/plugin/installer/oci_installer_unix_test.go
+++ b/internal/plugin/installer/oci_installer_unix_test.go
@@ -56,7 +56,7 @@ func TestExtractTarFileDescriptorLeak(t *testing.T) {
 	for i := 0; i < 100; i++ {
 		hdr := &tar.Header{
 			Name:     fmt.Sprintf("file_%d.txt", i),
-			Mode:     0600,
+			Mode:     0o600,
 			Size:     0,
 			Typeflag: tar.TypeReg,
 		}