diff --git a/src/libutil/tarfile.cc b/src/libutil/tarfile.cc
index 0e317457e..299847850 100644
--- a/src/libutil/tarfile.cc
+++ b/src/libutil/tarfile.cc
@@ -178,6 +178,10 @@ time_t unpackTarfileToSink(TarArchive & archive, ExtendedFileSystemObjectSink &
 {
     time_t lastModified = 0;
 
+    /* Only allocate the buffer once. Use the heap because 131 KiB is a bit too
+       much for the stack. */
+    std::vector<unsigned char> buf(128 * 1024);
+
     for (;;) {
         // FIXME: merge with extract_archive
         struct archive_entry * entry;
@@ -212,7 +216,6 @@ time_t unpackTarfileToSink(TarArchive & archive, ExtendedFileSystemObjectSink &
                     crf.isExecutable();
 
                 while (true) {
-                    std::vector<unsigned char> buf(128 * 1024);
                     auto n = archive_read_data(archive.archive, buf.data(), buf.size());
                     if (n < 0)
                         checkLibArchive(archive.archive, n, "cannot read file from tarball: %s");