diff --git a/README.md b/README.md
index fc7853e..40b071e 100644
--- a/README.md
+++ b/README.md
@@ -2,3 +2,13 @@
 
 [![codecov.io](https://codecov.io/github/codecov/codecov-circleci-orb/coverage.svg?branch=main)](https://codecov.io/github/codecov/codecov-circleci-orb)
 [![Circle CI](https://circleci.com/gh/codecov/codecov-circleci-orb.png?style=badge)](https://circleci.com/gh/codecov/codecov-circleci-orb)
+
+CircleCI orb for uploading coverage reports to [Codecov](https://codecov.io).
+
+This orb embeds the [Codecov Wrapper](https://github.com/codecov/wrapper) (`0.3.0`).
+
+## Parameters
+
+See [`src/commands/upload.yml`](./src/commands/upload.yml) for the full parameter list. Notable options:
+
+- `cleanup` — when `true`, download the CLI into a temporary directory and remove it after the run (off by default)
diff --git a/package-lock.json b/package-lock.json
index aad3adb..aa03318 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "codecov-circleci-orb",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "codecov-circleci-orb",
-      "version": "6.0.0",
+      "version": "6.1.0",
       "license": "MIT",
       "devDependencies": {
         "@types/mocha": "^9.1.0",
diff --git a/package.json b/package.json
index 311f415..5f77174 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codecov-circleci-orb",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "description": "Codecov CircleCI Orb",
   "main": "index.js",
   "devDependencies": {
diff --git a/src/commands/upload.yml b/src/commands/upload.yml
index 3930bd7..2e42e2e 100644
--- a/src/commands/upload.yml
+++ b/src/commands/upload.yml
@@ -29,6 +29,10 @@ parameters:
     description: The URL of the build where this is running
     type: string
     default: ""
+  cleanup:
+    description: If true, download the CLI into a temporary directory and clean it up after the run. Off by default to preserve legacy behavior of downloading into the current working directory.
+    type: boolean
+    default: false
   code:
     description: The code of the report if using local upload. If unsure, leave default. Read more here https://docs.codecov.com/docs/the-codecov-cli#how-to-use-local-upload
     type: string
@@ -185,6 +189,7 @@ steps:
         CODECOV_BRANCH: << parameters.branch >>
         CODECOV_BUILD: << parameters.build >>
         CODECOV_BUILD_URL: << parameters.build_url >>
+        CODECOV_CLEANUP: <<#parameters.cleanup>>true<</parameters.cleanup>><<^parameters.cleanup>>false<</parameters.cleanup>>
         CODECOV_CLI_TYPE: codecov-cli
         CODECOV_CODE: << parameters.code >>
         CODECOV_DIR: << parameters.dir >>
diff --git a/src/dist/download.sh b/src/dist/download.sh
index c24fda2..b2cf616 100755
--- a/src/dist/download.sh
+++ b/src/dist/download.sh
@@ -55,7 +55,7 @@ then
   else
     exit_if_error "Could not find binary file $CODECOV_BINARY"
   fi
-elif [ "$CODECOV_USE_PYPI" == "true" ];
+elif [ "$CODECOV_USE_PYPI" == "true" ] || [ "$CODECOV_USE_PYPI" == "1" ];
 then
   if ! pip install "${CODECOV_CLI_TYPE}$([ "$CODECOV_VERSION" == "latest" ] && echo "" || echo "==$CODECOV_VERSION")"; then
     exit_if_error "Could not install via pypi."
@@ -69,6 +69,15 @@ then
     CODECOV_COMMAND="${CODECOV_CLI_TYPE}"
   fi
 else
+  CODECOV_DOWNLOAD_DIR="."
+  if [ "$CODECOV_CLEANUP" == "true" ]; then
+    CODECOV_DOWNLOAD_DIR=$(mktemp -d)
+    cleanup_downloads() {
+      rm -rf "$CODECOV_DOWNLOAD_DIR"
+    }
+    trap cleanup_downloads EXIT
+  fi
+
   if [ -n "$CODECOV_OS" ];
   then
     say "$g==>$x Overridden OS: $b${CODECOV_OS}$x"
@@ -86,7 +95,7 @@ else
 
   CODECOV_FILENAME="${CODECOV_CLI_TYPE%-cli}"
   [[ $CODECOV_OS == "windows" ]] && CODECOV_FILENAME+=".exe"
-  CODECOV_COMMAND="./$CODECOV_FILENAME"
+  CODECOV_COMMAND="$CODECOV_DOWNLOAD_DIR/$CODECOV_FILENAME"
   [[ $CODECOV_OS == "macos" ]]  && \
     ! command -v gpg 2>&1 >/dev/null && \
     HOMEBREW_NO_AUTO_UPDATE=1 brew install gpg
@@ -94,7 +103,7 @@ else
   CODECOV_URL="$CODECOV_URL/${CODECOV_VERSION}"
   CODECOV_URL="$CODECOV_URL/${CODECOV_OS}/${CODECOV_FILENAME}"
   say "$g ->$x Downloading $b${CODECOV_URL}$x"
-  curl -O $retry "$CODECOV_URL"
+  curl -o "$CODECOV_COMMAND" $retry "$CODECOV_URL"
   say "$g==>$x Finishing downloading $b${CODECOV_OS}:${CODECOV_VERSION}$x"
 
   v_url="https://cli.codecov.io/api/${CODECOV_OS}/${CODECOV_VERSION}"
diff --git a/src/dist/set_defaults.sh b/src/dist/set_defaults.sh
index 91346a3..827b36e 100755
--- a/src/dist/set_defaults.sh
+++ b/src/dist/set_defaults.sh
@@ -46,11 +46,12 @@ r="\033[0;31m"  # errors
 x="\033[0m"
 retry="--retry 5 --retry-delay 2"
 
-CODECOV_WRAPPER_VERSION="0.2.9"
+CODECOV_WRAPPER_VERSION="0.3.0"
 CODECOV_VERSION="${CODECOV_VERSION:-latest}"
 CODECOV_FAIL_ON_ERROR="${CODECOV_FAIL_ON_ERROR:-false}"
 CODECOV_RUN_CMD="${CODECOV_RUN_CMD:-upload-coverage}"
 CODECOV_CLI_TYPE=${CODECOV_CLI_TYPE:-"codecov-cli"}
+CODECOV_CLEANUP="${CODECOV_CLEANUP:-false}"
 
 say "     _____          _
     / ____|        | |
diff --git a/src/dist/validate.sh b/src/dist/validate.sh
index e47ad97..e908f25 100755
--- a/src/dist/validate.sh
+++ b/src/dist/validate.sh
@@ -46,17 +46,30 @@ r="\033[0;31m"  # errors
 x="\033[0m"
 retry="--retry 5 --retry-delay 2"
 
-if [ "$CODECOV_SKIP_VALIDATION" == "true" ] || [ -n "$CODECOV_BINARY" ] || [ "$CODECOV_USE_PYPI" == "true" ];
+if [ "$CODECOV_SKIP_VALIDATION" == "true" ] || [ "$CODECOV_SKIP_VALIDATION" == "1" ] || [ -n "$CODECOV_BINARY" ] || [ "$CODECOV_USE_PYPI" == "true" ] || [ "$CODECOV_USE_PYPI" == "1" ];
 then
   say "$r==>$x Bypassing validation..."
-  if [ "$CODECOV_SKIP_VALIDATION" == "true" ];
+  if [ "$CODECOV_SKIP_VALIDATION" == "true" ] || [ "$CODECOV_SKIP_VALIDATION" == "1" ];
   then
     chmod +x "$CODECOV_COMMAND"
   fi
 else
-  echo "$(curl -s https://keybase.io/codecovsecops/pgp_keys.asc)" | \
-    gpg --no-default-keyring --import
-  # One-time step
+  gpg_key_url="https://keybase.io/codecovsecops/pgp_keys.asc"
+  gpg_import_ok=false
+  for gpg_attempt in 1 2 3; do
+    if curl -sf $retry "$gpg_key_url" | gpg --no-default-keyring --import; then
+      gpg_import_ok=true
+      break
+    fi
+    if [ "$gpg_attempt" -lt 3 ]; then
+      say "$r ->$x GPG key import attempt $gpg_attempt failed, retrying..."
+      sleep 2
+    fi
+  done
+  if [ "$gpg_import_ok" != "true" ]; then
+    exit_if_error "Could not import GPG verification key after 3 attempts. Please contact Codecov if problem continues"
+  fi
+
   say "$g==>$x Verifying GPG signature integrity"
   sha_url="https://cli.codecov.io"
   sha_url="${sha_url}/${CODECOV_VERSION}/${CODECOV_OS}"
@@ -65,16 +78,16 @@ else
   say "$g ->$x Downloading $b${sha_url}.sig$x"
   say " "
 
-  curl -Os $retry --connect-timeout 2 "$sha_url"
-  curl -Os $retry --connect-timeout 2 "${sha_url}.sig"
+  curl -o "$CODECOV_DOWNLOAD_DIR/${CODECOV_FILENAME}.SHA256SUM" -s $retry --connect-timeout 2 "$sha_url"
+  curl -o "$CODECOV_DOWNLOAD_DIR/${CODECOV_FILENAME}.SHA256SUM.sig" -s $retry --connect-timeout 2 "${sha_url}.sig"
 
-  if ! gpg --verify "${CODECOV_FILENAME}.SHA256SUM.sig" "${CODECOV_FILENAME}.SHA256SUM";
+  if ! gpg --verify "$CODECOV_DOWNLOAD_DIR/${CODECOV_FILENAME}.SHA256SUM.sig" "$CODECOV_DOWNLOAD_DIR/${CODECOV_FILENAME}.SHA256SUM";
   then
     exit_if_error "Could not verify signature. Please contact Codecov if problem continues"
   fi
 
-  if ! (shasum -a 256 -c "${CODECOV_FILENAME}.SHA256SUM" 2>/dev/null || \
-    sha256sum -c "${CODECOV_FILENAME}.SHA256SUM");
+  if ! (cd "$CODECOV_DOWNLOAD_DIR" && (shasum -a 256 -c "${CODECOV_FILENAME}.SHA256SUM" 2>/dev/null || \
+    sha256sum -c "${CODECOV_FILENAME}.SHA256SUM"));
   then
     exit_if_error "Could not verify SHASUM. Please contact Codecov if problem continues"
   fi
@@ -85,12 +98,17 @@ fi
 
 if [ -n "$CODECOV_BINARY_LOCATION" ];
 then
-  mkdir -p "$CODECOV_BINARY_LOCATION" && mv "$CODECOV_FILENAME" $_
+  mkdir -p "$CODECOV_BINARY_LOCATION" && mv "$CODECOV_COMMAND" "$CODECOV_BINARY_LOCATION/$CODECOV_FILENAME"
+  CODECOV_COMMAND="$CODECOV_BINARY_LOCATION/$CODECOV_FILENAME"
   say "$g==>$x ${CODECOV_CLI_TYPE} binary moved to ${CODECOV_BINARY_LOCATION}"
 fi
 
 if [ "$CODECOV_DOWNLOAD_ONLY" = "true" ];
 then
+  if [ "$CODECOV_CLEANUP" == "true" ] && [ -z "$CODECOV_BINARY_LOCATION" ]; then
+    cp "$CODECOV_COMMAND" "./$CODECOV_FILENAME"
+    CODECOV_COMMAND="./$CODECOV_FILENAME"
+  fi
   say "$g==>$x ${CODECOV_CLI_TYPE} download only called. Exiting..."
   exit
 fi
diff --git a/src/scripts b/src/scripts
index bad8df5..ce44ce7 160000
--- a/src/scripts
+++ b/src/scripts
@@ -1 +1 @@
-Subproject commit bad8df56cd845fa9c6115a924bbd3215e1926ec8
+Subproject commit ce44ce7e24763e2eee9897591963422ed672fede