diff --git a/changelogs/fragments/copy_keep_suffix_temp.yml b/changelogs/fragments/copy_keep_suffix_temp.yml
new file mode 100644
index 00000000000..d6dc36dc54e
--- /dev/null
+++ b/changelogs/fragments/copy_keep_suffix_temp.yml
@@ -0,0 +1,4 @@
+bugfixes:
+  - copy action now ensures that tempfiles use the same suffix as destination, to allow for ``validate`` to work with utilities that check extensions.
+  - copy action now also generates temprary files as hidden ('.' prefixed) to avoid accidental pickup by running services that glob by extension.
+  - template action will also inherit the behavior from copy (as it uses it internally).
diff --git a/lib/ansible/plugins/action/copy.py b/lib/ansible/plugins/action/copy.py
index 47bcd7a13e3..b0b1dc643f9 100644
--- a/lib/ansible/plugins/action/copy.py
+++ b/lib/ansible/plugins/action/copy.py
@@ -292,7 +292,12 @@ class ActionModule(ActionBase):
                 return result
 
             # Define a remote directory that we will copy the file to.
-            tmp_src = self._connection._shell.join_path(self._connection._shell.tmpdir, 'source')
+            tmp_src = self._connection._shell.join_path(self._connection._shell.tmpdir, '.source')
+
+            # ensure we keep suffix for validate
+            suffix = os.path.splitext(dest_file)[1]
+            if suffix:
+                tmp_src += suffix
 
             remote_path = None
 
@@ -385,7 +390,7 @@ class ActionModule(ActionBase):
 
     def _create_content_tempfile(self, content):
         ''' Create a tempfile containing defined content '''
-        fd, content_tempfile = tempfile.mkstemp(dir=C.DEFAULT_LOCAL_TMP)
+        fd, content_tempfile = tempfile.mkstemp(dir=C.DEFAULT_LOCAL_TMP, prefix='.')
         f = os.fdopen(fd, 'wb')
         content = to_bytes(content)
         try:
diff --git a/test/integration/targets/callback_default/callback_default.out.result_format_yaml_lossy_verbose.stdout b/test/integration/targets/callback_default/callback_default.out.result_format_yaml_lossy_verbose.stdout
index ed455756ba8..51f025162f8 100644
--- a/test/integration/targets/callback_default/callback_default.out.result_format_yaml_lossy_verbose.stdout
+++ b/test/integration/targets/callback_default/callback_default.out.result_format_yaml_lossy_verbose.stdout
@@ -166,7 +166,7 @@ changed: [testhost] =>
     mode: '0644'
     owner: root
     size: 3
-    src: .../source
+    src: .../.source.txt
     state: file
     uid: 0
 
diff --git a/test/integration/targets/callback_default/callback_default.out.result_format_yaml_verbose.stdout b/test/integration/targets/callback_default/callback_default.out.result_format_yaml_verbose.stdout
index 3a121a5f9f1..8fd5b4f0e87 100644
--- a/test/integration/targets/callback_default/callback_default.out.result_format_yaml_verbose.stdout
+++ b/test/integration/targets/callback_default/callback_default.out.result_format_yaml_verbose.stdout
@@ -173,7 +173,7 @@ changed: [testhost] =>
     mode: '0644'
     owner: root
     size: 3
-    src: .../source
+    src: .../.source.txt
     state: file
     uid: 0
 
diff --git a/test/integration/targets/callback_default/runme.sh b/test/integration/targets/callback_default/runme.sh
index a815132a5c2..eab50bfb328 100755
--- a/test/integration/targets/callback_default/runme.sh
+++ b/test/integration/targets/callback_default/runme.sh
@@ -34,7 +34,7 @@ run_test() {
 	sed -i -e 's/^Using .*//g' "${OUTFILE}.${testname}.stdout"
 	sed -i -e 's/[0-9]:[0-9]\{2\}:[0-9]\{2\}\.[0-9]\{6\}/0:00:00.000000/g' "${OUTFILE}.${testname}.stdout"
 	sed -i -e 's/[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\} [0-9]\{2\}:[0-9]\{2\}:[0-9]\{2\}\.[0-9]\{6\}/0000-00-00 00:00:00.000000/g' "${OUTFILE}.${testname}.stdout"
-	sed -i -e 's#: .*/source$#: .../source#g' "${OUTFILE}.${testname}.stdout"
+	sed -i -e 's#: .*/\.source\.txt$#: .../.source.txt#g' "${OUTFILE}.${testname}.stdout"
 	sed -i -e '/secontext:/d' "${OUTFILE}.${testname}.stdout"
 	sed -i -e 's/group: wheel/group: root/g' "${OUTFILE}.${testname}.stdout"