diff --git a/src/libutil/tarfile.cc b/src/libutil/tarfile.cc
index 53886747a..5fb912df7 100644
--- a/src/libutil/tarfile.cc
+++ b/src/libutil/tarfile.cc
@@ -182,6 +182,10 @@ time_t unpackTarfileToSink(TarArchive & archive, ExtendedFileSystemObjectSink &
 {
     time_t lastModified = 0;
 
+    /* Only allocate the buffer once. Use the heap because 131 KiB is a bit too
+       much for the stack. */
+    std::vector<unsigned char> buf(128 * 1024);
+
     for (;;) {
         // FIXME: merge with extract_archive
         struct archive_entry * entry;
@@ -216,7 +220,6 @@ time_t unpackTarfileToSink(TarArchive & archive, ExtendedFileSystemObjectSink &
                     crf.isExecutable();
 
                 while (true) {
-                    std::vector<unsigned char> buf(128 * 1024);
                     auto n = archive_read_data(archive.archive, buf.data(), buf.size());
                     if (n < 0)
                         throw Error("cannot read file '%s' from tarball", path);