diff --git a/build_library/release_util.sh b/build_library/release_util.sh
index 7b20d383df..db2e33b220 100644
--- a/build_library/release_util.sh
+++ b/build_library/release_util.sh
@@ -124,13 +124,16 @@ sign_and_upload_files() {
     local suffix="$3"
     shift 3
 
+    # run a subshell to possibly clean the temporary directory with
+    # signatures without clobbering the global EXIT trap
+    (
     # Create simple GPG detached signature for all uploads.
     local sigs=()
     if [[ -n "${FLAGS_sign}" ]]; then
         local file
         local sigfile
         local sigdir=$(mktemp --directory)
-        trap "rm -rf ${sigdir}" RETURN
+        trap "rm -rf ${sigdir}" EXIT
         for file in "$@"; do
             if [[ "${file}" =~ \.(asc|gpg|sig)$ ]]; then
                 continue
@@ -150,6 +153,7 @@ sign_and_upload_files() {
     fi
 
     upload_files "${msg}" "${path}" "${suffix}" "$@" "${sigs[@]}"
+    )
 }
 
 upload_packages() {
diff --git a/build_torcx_store b/build_torcx_store
index 524f69b42a..5572c7d5b0 100755
--- a/build_torcx_store
+++ b/build_torcx_store
@@ -114,13 +114,16 @@ function torcx_package() {
         local name=${name##*/}
         local version=${version%%-r*}
 
+        # Run in a subshell to clean tmproot and tmppkgroot up without
+        # clobbering this shell's EXIT trap.
+        (
         # Set up the base package layout to dump everything into /bin and /lib.
         # tmproot is what the packages are installed into.
         # A subset of the files from tmproot are then moved into tmppkgroot,
         # which is then archived and uploaded.
         tmproot=$(sudo mktemp --tmpdir="${BUILD_DIR}" -d)
         tmppkgroot=$(sudo mktemp --tmpdir="${BUILD_DIR}" -d)
-        trap "sudo rm -rf '${tmproot}' '${tmppkgroot}'" EXIT RETURN
+        trap "sudo rm -rf '${tmproot}' '${tmppkgroot}'" EXIT
         sudo chmod 0755 "${tmproot}" "${tmppkgroot}"
         sudo mkdir -p "${tmproot}"/{.torcx,bin,lib,usr}
         sudo ln -fns ../bin "${tmproot}/usr/bin"
@@ -228,8 +231,7 @@ function torcx_package() {
             "${source_pkg}" \
             "${update_default}" \
             "${pkg_locations[@]}"
-
-        trap - EXIT
+        )
 }
 
 # This list defines every torcx image that goes into the vendor store for the
diff --git a/jenkins/images.sh b/jenkins/images.sh
index 9a688d953b..faced8cd66 100755
--- a/jenkins/images.sh
+++ b/jenkins/images.sh
@@ -43,7 +43,10 @@ sudo rm -rf chroot/build src/build torcx
 
 enter() {
         local verify_key=
-        trap 'sudo rm -f chroot/etc/portage/gangue.*' RETURN
+        # Run in a subshell to clean some gangue files on exit without
+        # possibly clobbering the global EXIT trap.
+        (
+        trap 'sudo rm -f chroot/etc/portage/gangue.*' EXIT
         [ -s verify.asc ] &&
         sudo ln -f verify.asc chroot/etc/portage/gangue.asc &&
         verify_key=--verify-key=/etc/portage/gangue.asc
@@ -55,6 +58,7 @@ enter() {
 --json-key=/etc/portage/gangue.json $verify_key \
 "'"${URI}" "${DISTDIR}/${FILE}"' \
             "$@"
+        )
 }
 
 script() {
diff --git a/jenkins/packages.sh b/jenkins/packages.sh
index 8704929b55..670f83aa0b 100755
--- a/jenkins/packages.sh
+++ b/jenkins/packages.sh
@@ -47,7 +47,10 @@ bin/cork update \
 
 enter() {
         local verify_key=
-        trap 'sudo rm -f chroot/etc/portage/gangue.*' RETURN
+        # Run in a subshell to clean some gangue files on exit without
+        # possibly clobbering the global EXIT trap.
+        (
+        trap 'sudo rm -f chroot/etc/portage/gangue.*' EXIT
         [ -s verify.asc ] &&
         sudo ln -f verify.asc chroot/etc/portage/gangue.asc &&
         verify_key=--verify-key=/etc/portage/gangue.asc
@@ -60,6 +63,7 @@ enter() {
 --json-key=/etc/portage/gangue.json $verify_key \
 "'"${URI}" "${DISTDIR}/${FILE}"' \
             "$@"
+        )
 }
 
 script() {
diff --git a/jenkins/vms.sh b/jenkins/vms.sh
index eee3d719bf..4222b57d86 100755
--- a/jenkins/vms.sh
+++ b/jenkins/vms.sh
@@ -43,7 +43,10 @@ sudo rm -rf chroot/build tmp
 
 enter() {
         local verify_key=
-        trap 'sudo rm -f chroot/etc/portage/gangue.*' RETURN
+        # Run in a subshell to clean some gangue files on exit without
+        # possibly clobbering the global EXIT trap.
+        (
+        trap 'sudo rm -f chroot/etc/portage/gangue.*' EXIT
         [ -s verify.asc ] &&
         sudo ln -f verify.asc chroot/etc/portage/gangue.asc &&
         verify_key=--verify-key=/etc/portage/gangue.asc
@@ -55,6 +58,7 @@ enter() {
 --json-key=/etc/portage/gangue.json $verify_key \
 "'"${URI}" "${DISTDIR}/${FILE}"' \
             "$@"
+        )
 }
 
 script() {