diff --git a/bin/dither/dither.rb b/bin/dither/dither.rb
index b0095e8..1a9284f 100644
--- a/bin/dither/dither.rb
+++ b/bin/dither/dither.rb
@@ -1,5 +1,6 @@
 require "sinatra"
 require "mini_magick"
+require "tempfile"
 
 MiniMagick.logger.level = Logger::DEBUG
 
@@ -16,37 +17,50 @@ get "/*" do |path|
   geometry = params["geo"] unless params["geo"] == ""
   geometry.gsub!(/\d+/) { |n| n.to_i * 2 } if geometry && !DITHER
 
-  decrypted = %x(
-    openssl \
-      aes-256-cbc \
-      -d \
-      -in #{ROOT}/#{path}.enc \
-      -pass file:#{KEY} \
-      -iter 1000000
-  )
+  decrypted = Tempfile.new(["dither", File.extname(path)])
+  decrypted.binmode
+  decrypted.close
 
-  convert = MiniMagick::Tool::Convert.new
-  convert.stdin
-  convert.background("white")
-  convert.layers("flatten")
-  convert.strip
-  convert.auto_orient
+  begin
+    openssl_ok = system(
+      "openssl",
+      "aes-256-cbc",
+      "-d",
+      "-in", "#{ROOT}/#{path}.enc",
+      "-out", decrypted.path,
+      "-pass", "file:#{KEY}",
+      "-iter", "1000000"
+    )
+    halt 500, {"Content-Type" => "text/plain"}, "decrypt failed" unless openssl_ok
 
-  if geometry
-    if geometry.match?(/^\d+x\d+$/)
-      convert.resize "#{geometry}^"
-      convert.gravity "center"
-      convert.extent geometry
-    else
-      convert.resize geometry
+    convert = MiniMagick::Tool::Convert.new
+    convert.limit("memory", "128MiB")
+    convert.limit("map", "256MiB")
+    convert.limit("disk", "1GiB")
+    convert << decrypted.path
+    convert.background("white")
+    convert.layers("flatten")
+    convert.strip
+    convert.auto_orient
+
+    if geometry
+      if geometry.match?(/^\d+x\d+$/)
+        convert.resize "#{geometry}^"
+        convert.gravity "center"
+        convert.extent geometry
+      else
+        convert.resize geometry
+      end
     end
-  end
 
-  if DITHER
-    convert.ordered_dither "o8x8"
-    convert.monochrome
-  end
+    if DITHER
+      convert.ordered_dither "o8x8"
+      convert.monochrome
+    end
 
-  convert << "#{FORMAT.upcase}:-"
-  convert.call(stdin: decrypted)
+    convert << "#{FORMAT.upcase}:-"
+    convert.call
+  ensure
+    decrypted.unlink
+  end
 end