diff --git a/crash-reporter/crash_collector.cc b/crash-reporter/crash_collector.cc
index 24b7f8b..7340c76 100644
--- a/crash-reporter/crash_collector.cc
+++ b/crash-reporter/crash_collector.cc
@@ -33,13 +33,14 @@
 
 const char kCollectChromeFile[] =
     "/mnt/stateful_partition/etc/collect_chrome_crashes";
-const char kCrashTestInProgressPath[] = "/tmp/crash-test-in-progress";
+const char kCrashTestInProgressPath[] = "crash-test-in-progress";
 const char kDefaultLogConfig[] = "/etc/crash_reporter_logs.conf";
 const char kDefaultUserName[] = "chronos";
 const char kLeaveCoreFile[] = "/root/.leave_core";
 const char kLsbRelease[] = "/etc/lsb-release";
 const char kShellPath[] = "/bin/sh";
 const char kSystemCrashPath[] = "/var/spool/crash";
+const char kSystemRunStatePath[] = "/run/crash_reporter";
 const char kUploadVarPrefix[] = "upload_var_";
 const char kUploadTextPrefix[] = "upload_text_";
 const char kUploadFilePrefix[] = "upload_file_";
@@ -65,6 +66,10 @@
 // Directory mode of the system crash spool directory.
 const mode_t kSystemCrashPathMode = 01755;
 
+// Directory mode of the run time state directory.
+// Since we place flag files in here for checking by tests, we make it readable.
+constexpr mode_t kSystemRunStatePathMode = 0755;
+
 const uid_t kRootGroup = 0;
 
 // Buffer size for reading a log into memory.
@@ -665,7 +670,8 @@
 }
 
 bool CrashCollector::IsCrashTestInProgress() {
-  return base::PathExists(FilePath(kCrashTestInProgressPath));
+  return base::PathExists(
+      FilePath(kSystemRunStatePath).Append(kCrashTestInProgressPath));
 }
 
 bool CrashCollector::IsDeveloperImage() {
@@ -723,5 +729,10 @@
       FilePath(kSystemCrashPath), kSystemCrashPathMode, kRootUid, kRootGroup))
     return false;
 
+  if (!CreateDirectoryWithSettings(
+      FilePath(kSystemRunStatePath), kSystemRunStatePathMode, kRootUid,
+      kRootGroup))
+    return false;
+
   return true;
 }
diff --git a/crash-reporter/crash_sender b/crash-reporter/crash_sender
index 7e2ab2b..57cf5f9 100755
--- a/crash-reporter/crash_sender
+++ b/crash-reporter/crash_sender
@@ -12,8 +12,11 @@
 # Crash sender lock in case the sender is already running.
 CRASH_SENDER_LOCK="/run/lock/crash_sender"
 
+# The base directory where we keep various state flags.
+CRASH_RUN_STATE_DIR="/run/crash_reporter"
+
 # Path to file that indicates a crash test is currently running.
-CRASH_TEST_IN_PROGRESS_FILE="/tmp/crash-test-in-progress"
+CRASH_TEST_IN_PROGRESS_FILE="${CRASH_RUN_STATE_DIR}/crash-test-in-progress"
 
 # Path to find which is required for computing the crash rate.
 FIND="/usr/bin/find"
@@ -39,7 +42,7 @@
 
 # File whose existence mocks crash sending.  If empty we pretend the
 # crash sending was successful, otherwise unsuccessful.
-MOCK_CRASH_SENDING="/tmp/mock-crash-sending"
+MOCK_CRASH_SENDING="${CRASH_RUN_STATE_DIR}/mock-crash-sending"
 
 # Set this to 1 in the environment to pretend to have booted in developer
 # mode.  This is used by autotests.