diff --git a/lib/functions/bsp/bsp-desktop.sh b/lib/functions/bsp/bsp-desktop.sh
index 01c3d77d6..86ca4333c 100644
--- a/lib/functions/bsp/bsp-desktop.sh
+++ b/lib/functions/bsp/bsp-desktop.sh
@@ -1,12 +1,13 @@
 #!/usr/bin/env bash
 
-create_desktop_package() {
+function create_desktop_package() {
 	# produced by aggregation.py
 	display_alert "bsp-desktop: AGGREGATED_PACKAGES_DESKTOP_COMMA" "'${AGGREGATED_PACKAGES_DESKTOP_COMMA}'" "debug"
 
-	local destination tmp_dir
-	tmp_dir=$(mktemp -d) # subject to TMPDIR/WORKDIR, so is protected by single/common error trapmanager to clean-up.
-	destination=${tmp_dir}/${BOARD}/${CHOSEN_DESKTOP}_${REVISION}_all
+	declare cleanup_id="" tmp_dir=""
+	prepare_temp_dir_in_workdir_and_schedule_cleanup "bsp-desktop" cleanup_id tmp_dir # namerefs
+
+	declare destination="${tmp_dir}/${BOARD}/${CHOSEN_DESKTOP}_${REVISION}_all"
 	rm -rf "${destination}"
 	mkdir -p "${destination}"/DEBIAN
 
@@ -42,14 +43,18 @@ create_desktop_package() {
 	cd "${destination}" || exit_with_error "Failed to cd to ${destination}"
 	cd ..
 	fakeroot_dpkg_deb_build "${destination}" "${DEB_STORAGE}/${RELEASE}/${CHOSEN_DESKTOP}_${REVISION}_all.deb"
+
+	done_with_temp_dir "${cleanup_id}" # changes cwd to "${SRC}" and fires the cleanup function early
 }
 
-create_bsp_desktop_package() {
+function create_bsp_desktop_package() {
 	display_alert "Creating board support package for desktop" "${package_name}" "info"
+
 	local package_name="${BSP_DESKTOP_PACKAGE_FULLNAME}"
-	local destination tmp_dir
-	tmp_dir=$(mktemp -d) # subject to TMPDIR/WORKDIR, so is protected by single/common error trapmanager to clean-up.
-	destination=${tmp_dir}/${BOARD}/${BSP_DESKTOP_PACKAGE_FULLNAME}
+	declare cleanup_id="" tmp_dir=""
+	prepare_temp_dir_in_workdir_and_schedule_cleanup "bsp-desktop2" cleanup_id tmp_dir # namerefs
+
+	local destination=${tmp_dir}/${BOARD}/${BSP_DESKTOP_PACKAGE_FULLNAME}
 	rm -rf "${destination}"
 	mkdir -p "${destination}"/DEBIAN
 
@@ -84,4 +89,6 @@ create_bsp_desktop_package() {
 	cd "${destination}" || exit_with_error "Failed to cd to ${destination}"
 	cd ..
 	fakeroot_dpkg_deb_build "${destination}" "${DEB_STORAGE}/${RELEASE}/${package_name}.deb"
+
+	done_with_temp_dir "${cleanup_id}" # changes cwd to "${SRC}" and fires the cleanup function early
 }
diff --git a/lib/functions/compilation/kernel-debs.sh b/lib/functions/compilation/kernel-debs.sh
index 8fdce76a0..dc3d64be6 100644
--- a/lib/functions/compilation/kernel-debs.sh
+++ b/lib/functions/compilation/kernel-debs.sh
@@ -78,9 +78,8 @@ function create_kernel_deb() {
 	declare deb_output_dir="${2}"
 	declare callback_function="${3}"
 
-	declare package_directory
-	package_directory=$(mktemp -d "${WORKDIR}/${package_name}.XXXXXXXXX") # explicitly created in WORKDIR, so is protected by that cleanup trap already
-	#display_alert "package_directory" "${package_directory}" "debug"
+	declare cleanup_id="" package_directory=""
+	prepare_temp_dir_in_workdir_and_schedule_cleanup "deb-k-${package_name}" cleanup_id package_directory # namerefs
 
 	declare package_DEBIAN_dir="${package_directory}/DEBIAN" # DEBIAN dir
 	mkdir -p "${package_DEBIAN_dir}"                         # maintainer scripts et al
@@ -129,6 +128,8 @@ function create_kernel_deb() {
 	#run_host_command_logged tree -C -h -d --du "${package_directory}"
 
 	run_host_command_logged dpkg-deb ${DEB_COMPRESS:+-Z$DEB_COMPRESS} --build "${package_directory}" "${deb_output_dir}" # not KDEB compress, we're not under a Makefile
+
+	done_with_temp_dir "${cleanup_id}" # changes cwd to "${SRC}" and fires the cleanup function early
 }
 
 function kernel_package_hook_helper() {
diff --git a/lib/functions/compilation/kernel.sh b/lib/functions/compilation/kernel.sh
index 3dc38c6d7..4db8cb6c2 100644
--- a/lib/functions/compilation/kernel.sh
+++ b/lib/functions/compilation/kernel.sh
@@ -92,8 +92,9 @@ function kernel_package_source() {
 	display_alert "Creating kernel source package" "${LINUXCONFIG}" "info"
 
 	local ts=${SECONDS}
-	local sources_pkg_dir tmp_src_dir tarball_size package_size
-	tmp_src_dir=$(mktemp -d) # subject to TMPDIR/WORKDIR, so is protected by single/common error trapmanager to clean-up.
+	local sources_pkg_dir tarball_size package_size
+	declare cleanup_id="" tmp_src_dir=""
+	prepare_temp_dir_in_workdir_and_schedule_cleanup "ksrc" cleanup_id tmp_src_dir # namerefs
 
 	sources_pkg_dir="${tmp_src_dir}/${CHOSEN_KSRC}_${REVISION}_all"
 
@@ -128,9 +129,14 @@ function kernel_package_source() {
 	EOF
 
 	fakeroot_dpkg_deb_build -Znone -z0 "${sources_pkg_dir}" "${sources_pkg_dir}.deb" # do not compress .deb, it already contains a zstd compressed tarball! ignores ${KDEB_COMPRESS} on purpose
+
 	package_size="$(du -h -s "${sources_pkg_dir}.deb" | awk '{print $1}')"
+
 	run_host_command_logged rsync --remove-source-files -r "${sources_pkg_dir}.deb" "${DEB_STORAGE}/"
+
 	display_alert "$(basename "${sources_pkg_dir}.deb" ".deb") packaged" "$((SECONDS - ts)) seconds, ${tarball_size} tarball, ${package_size} .deb" "info"
+
+	done_with_temp_dir "${cleanup_id}" # changes cwd to "${SRC}" and fires the cleanup function early
 }
 
 function kernel_prepare_build_and_package() {
@@ -139,8 +145,9 @@ function kernel_prepare_build_and_package() {
 	declare -a install_make_params_quoted
 	declare -A kernel_install_dirs
 
-	build_targets=("all")                                              # "All" builds the vmlinux/Image/Image.gz default for the ${ARCH}
-	kernel_dest_install_dir=$(mktemp -d "${WORKDIR}/kernel.XXXXXXXXX") # subject to TMPDIR/WORKDIR, so is protected by single/common error trapmanager to clean-up.
+	build_targets=("all") # "All" builds the vmlinux/Image/Image.gz default for the ${ARCH}
+	declare cleanup_id="" kernel_dest_install_dir=""
+	prepare_temp_dir_in_workdir_and_schedule_cleanup "k" cleanup_id kernel_dest_install_dir # namerefs
 
 	# define dict with vars passed and target directories
 	declare -A kernel_install_dirs=(
@@ -169,6 +176,8 @@ function kernel_prepare_build_and_package() {
 	LOG_SECTION="kernel_build" do_with_logging do_with_hooks kernel_build
 
 	LOG_SECTION="kernel_package" do_with_logging do_with_hooks kernel_package
+
+	done_with_temp_dir "${cleanup_id}" # changes cwd to "${SRC}" and fires the cleanup function early
 }
 
 function kernel_build() {
diff --git a/lib/functions/compilation/packages/armbian-config-deb.sh b/lib/functions/compilation/packages/armbian-config-deb.sh
index a343d1f00..9988be03b 100644
--- a/lib/functions/compilation/packages/armbian-config-deb.sh
+++ b/lib/functions/compilation/packages/armbian-config-deb.sh
@@ -1,10 +1,9 @@
 compile_armbian-config() {
 
-	local tmp_dir armbian_config_dir
-	tmp_dir=$(mktemp -d) # subject to TMPDIR/WORKDIR, so is protected by single/common error trapmanager to clean-up.
-	chmod 700 "${tmp_dir}"
+	declare cleanup_id="" tmp_dir=""
+	prepare_temp_dir_in_workdir_and_schedule_cleanup "deb-armbian-config" cleanup_id tmp_dir # namerefs
 
-	armbian_config_dir=armbian-config_${REVISION}_all
+	declare armbian_config_dir="armbian-config_${REVISION}_all"
 	display_alert "Building deb" "armbian-config" "info"
 
 	fetch_from_repo "https://github.com/armbian/config" "armbian-config" "branch:master"
@@ -48,5 +47,9 @@ compile_armbian-config() {
 	ln -sf /usr/sbin/softy "${tmp_dir}/${armbian_config_dir}"/usr/bin/softy
 
 	fakeroot_dpkg_deb_build "${tmp_dir}/${armbian_config_dir}"
+
 	run_host_command_logged rsync --remove-source-files -r "${tmp_dir}/${armbian_config_dir}.deb" "${DEB_STORAGE}/"
+
+	done_with_temp_dir "${cleanup_id}" # changes cwd to "${SRC}" and fires the cleanup function early 
+
 }
diff --git a/lib/functions/compilation/packages/plymouth-deb.sh b/lib/functions/compilation/packages/plymouth-deb.sh
index 659b3f6fc..120726198 100644
--- a/lib/functions/compilation/packages/plymouth-deb.sh
+++ b/lib/functions/compilation/packages/plymouth-deb.sh
@@ -1,9 +1,9 @@
 compile_plymouth_theme_armbian() {
 
-	local tmp_dir plymouth_theme_armbian_dir
-	tmp_dir=$(mktemp -d)
-	chmod 700 "${tmp_dir}"
-	plymouth_theme_armbian_dir=armbian-plymouth-theme_${REVISION}_all
+	declare cleanup_id="" tmp_dir=""
+	prepare_temp_dir_in_workdir_and_schedule_cleanup "deb-armbian-plymouth-theme" cleanup_id tmp_dir # namerefs
+
+	declare plymouth_theme_armbian_dir=armbian-plymouth-theme_${REVISION}_all
 	display_alert "Building deb" "armbian-plymouth-theme" "info"
 
 	run_host_command_logged mkdir -p "${tmp_dir}/${plymouth_theme_armbian_dir}"/{DEBIAN,usr/share/plymouth/themes/armbian}
@@ -44,7 +44,8 @@ compile_plymouth_theme_armbian() {
 		"${tmp_dir}/${plymouth_theme_armbian_dir}"/usr/share/plymouth/themes/armbian/
 
 	fakeroot_dpkg_deb_build "${tmp_dir}/${plymouth_theme_armbian_dir}"
+
 	run_host_command_logged rsync --remove-source-files -rq "${tmp_dir}/${plymouth_theme_armbian_dir}.deb" "${DEB_STORAGE}/"
 
-	# does not remove the tmpdir; it's under TMPDIR anyway
+	done_with_temp_dir "${cleanup_id}" # changes cwd to "${SRC}" and fires the cleanup function early
 }
diff --git a/lib/functions/compilation/packages/zsh-deb.sh b/lib/functions/compilation/packages/zsh-deb.sh
index fbd6db231..a43223c28 100644
--- a/lib/functions/compilation/packages/zsh-deb.sh
+++ b/lib/functions/compilation/packages/zsh-deb.sh
@@ -1,9 +1,8 @@
 compile_armbian-zsh() {
-	local tmp_dir armbian_zsh_dir
-	tmp_dir=$(mktemp -d) # subject to TMPDIR/WORKDIR, so is protected by single/common error trapmanager to clean-up.
-	chmod 700 "${tmp_dir}"
+	declare cleanup_id="" tmp_dir=""
+	prepare_temp_dir_in_workdir_and_schedule_cleanup "deb-zsh" cleanup_id tmp_dir # namerefs
 
-	armbian_zsh_dir=armbian-zsh_${REVISION}_all
+	declare armbian_zsh_dir="armbian-zsh_${REVISION}_all"
 	display_alert "Building deb" "armbian-zsh" "info"
 
 	fetch_from_repo "$GITHUB_SOURCE/ohmyzsh/ohmyzsh" "oh-my-zsh" "branch:master"
@@ -68,5 +67,8 @@ compile_armbian-zsh() {
 	chmod 755 "${tmp_dir}/${armbian_zsh_dir}"/DEBIAN/postinst
 
 	fakeroot_dpkg_deb_build "${tmp_dir}/${armbian_zsh_dir}"
+
 	run_host_command_logged rsync --remove-source-files -r "${tmp_dir}/${armbian_zsh_dir}.deb" "${DEB_STORAGE}/"
+
+	done_with_temp_dir "${cleanup_id}" # changes cwd to "${SRC}" and fires the cleanup function early
 }
diff --git a/lib/functions/compilation/uboot.sh b/lib/functions/compilation/uboot.sh
index 7fe83b1ce..2dd85d38c 100644
--- a/lib/functions/compilation/uboot.sh
+++ b/lib/functions/compilation/uboot.sh
@@ -263,8 +263,9 @@ function compile_uboot() {
 	local uboot_name="${CHOSEN_UBOOT}_${REVISION}_${ARCH}"
 
 	# create directory structure for the .deb package
-	uboottempdir="$(mktemp -d)" # subject to TMPDIR/WORKDIR, so is protected by single/common error trapmanager to clean-up.
-	chmod 700 "${uboottempdir}"
+	declare cleanup_id="" uboottempdir=""
+	prepare_temp_dir_in_workdir_and_schedule_cleanup "uboot" cleanup_id uboottempdir # namerefs
+
 	mkdir -p "$uboottempdir/$uboot_name/usr/lib/u-boot" "$uboottempdir/$uboot_name/usr/lib/$uboot_name" "$uboottempdir/$uboot_name/DEBIAN"
 
 	# Allow extension-based u-boot bulding. We call the hook, and if EXTENSION_BUILT_UBOOT="yes" afterwards, we skip our own compilation.
@@ -350,6 +351,8 @@ function compile_uboot() {
 
 	run_host_command_logged rsync --remove-source-files -r "$uboottempdir/${uboot_name}.deb" "${DEB_STORAGE}/"
 
+	done_with_temp_dir "${cleanup_id}" # changes cwd to "${SRC}" and fires the cleanup function early
+
 	display_alert "Built u-boot deb OK" "${uboot_name}.deb" "info"
 	return 0 # success
 }
diff --git a/lib/functions/image/loop.sh b/lib/functions/image/loop.sh
index c4358cb01..80028faf4 100644
--- a/lib/functions/image/loop.sh
+++ b/lib/functions/image/loop.sh
@@ -57,9 +57,10 @@ function write_uboot_to_loop_image() {
 	declare loop=$1
 	display_alert "Preparing u-boot bootloader" "LOOP=${loop} - ${CHOSEN_UBOOT}" "info"
 
-	declare TEMP_DIR revision="${REVISION}"
-	TEMP_DIR="$(mktemp -d)" # Subject to TMPDIR, so common trap applies
-	chmod 700 "${TEMP_DIR}"
+	declare revision="${REVISION}"
+	declare cleanup_id="" TEMP_DIR=""
+	prepare_temp_dir_in_workdir_and_schedule_cleanup "uboot-write" cleanup_id TEMP_DIR # namerefs
+
 	if [[ -n $UBOOT_REPO_VERSION ]]; then
 		revision=${UBOOT_REPO_VERSION}
 		run_host_command_logged dpkg -x "${DEB_STORAGE}/linux-u-boot-${BOARD}-${BRANCH}_${revision}_${ARCH}.deb" "${TEMP_DIR}"/
@@ -88,8 +89,7 @@ function write_uboot_to_loop_image() {
 		Consider that `write_uboot_platform()` is also called board-side, when updating uboot, eg: nand-sata-install.
 	POST_WRITE_UBOOT_PLATFORM
 
-	# cleanup
-	rm -rf "${TEMP_DIR}"
+	done_with_temp_dir "${cleanup_id}" # changes cwd to "${SRC}" and fires the cleanup function early
 
 	return 0
 }