diff --git a/tests/create-directory b/tests/create-directory
index 2e60248..2d5461b 100644
--- a/tests/create-directory
+++ b/tests/create-directory
@@ -1,7 +1,9 @@
 #!/bin/sh
 set -eu
 export LC_ALL=C.UTF-8
+
+trap "rm -rf /tmp/debian-chroot" EXIT INT TERM
+
 {{ CMD }} --mode=root --variant=apt {{ DIST }} /tmp/debian-chroot {{ MIRROR }}
 chroot /tmp/debian-chroot dpkg-query --showformat '${binary:Package}\n' --show > pkglist.txt
 tar -C /tmp/debian-chroot --one-file-system -c . | tar -t | sort > tar1.txt
-rm -r /tmp/debian-chroot
diff --git a/tests/fail-installing-to-existing-file b/tests/fail-installing-to-existing-file
index 5a633fc..916c98c 100644
--- a/tests/fail-installing-to-existing-file
+++ b/tests/fail-installing-to-existing-file
@@ -1,6 +1,9 @@
 #!/bin/sh
 set -eu
 export LC_ALL=C.UTF-8
+
+trap "rm -f /tmp/exists" EXIT INT TERM
+
 touch /tmp/exists
 ret=0
 {{ CMD }} --mode={{ MODE }} --variant=apt {{ DIST }} /tmp/exists {{ MIRROR }} || ret=$?
diff --git a/tests/fail-with-path-with-quotes b/tests/fail-with-path-with-quotes
index 0cb2631..5483ff1 100644
--- a/tests/fail-with-path-with-quotes
+++ b/tests/fail-with-path-with-quotes
@@ -1,6 +1,9 @@
 #!/bin/sh
 set -eu
 export LC_ALL=C.UTF-8
+
+trap 'rm -rf /tmp/quoted\"path' EXIT INT TERM
+
 ret=0
 {{ CMD }} --mode={{ MODE }} --variant=apt {{ DIST }} /tmp/quoted\"path {{ MIRROR }} || ret=$?
 if [ "$ret" = 0 ]; then
diff --git a/tests/include-deb-file b/tests/include-deb-file
index 41e2528..894038d 100644
--- a/tests/include-deb-file
+++ b/tests/include-deb-file
@@ -3,6 +3,8 @@
 set -eu
 export LC_ALL=C.UTF-8
 
+trap "rm -rf /tmp/dummypkg.deb /tmp/dummypkg" EXIT INT TERM
+
 # instead of obtaining a .deb from our cache, we create a new package because
 # otherwise apt might decide to download the package with the same name and
 # version from the cache instead of using the local .deb
diff --git a/tests/install-busybox-based-sub-essential-system b/tests/install-busybox-based-sub-essential-system
index 7a78fe5..94e036f 100644
--- a/tests/install-busybox-based-sub-essential-system
+++ b/tests/install-busybox-based-sub-essential-system
@@ -1,6 +1,9 @@
 #!/bin/sh
 set -eu
 export LC_ALL=C.UTF-8
+
+trap "rm -rf /tmp/debian-chroot" EXIT INT TERM
+
 pkgs=base-files,base-passwd,busybox,debianutils,dpkg,libc-bin,mawk,tar
 # busybox --install -s will install symbolic links into the rootfs, leaving
 # existing files untouched. It has to run after extraction (otherwise there is
@@ -31,4 +34,3 @@ chroot /tmp/debian-chroot echo foobar \
 	| chroot /tmp/debian-chroot tee /dev/null \
 	| chroot /tmp/debian-chroot sed 's/foobar/blubber/' \
 	| chroot /tmp/debian-chroot grep blubber >/dev/null
-rm -r /tmp/debian-chroot
diff --git a/tests/install-doc-debian b/tests/install-doc-debian
index 407dcff..81cb513 100644
--- a/tests/install-doc-debian
+++ b/tests/install-doc-debian
@@ -5,6 +5,8 @@ export LC_ALL=C.UTF-8
 [ {{ VARIANT }} = "custom" ]
 [ {{ MODE }} = "chrootless" ]
 
+trap "rm -rf /tmp/debian-chroot" EXIT INT TERM
+
 prefix=
 if [ "$(id -u)" -eq 0 ] && [ "{{ MODE }}" != "root" ] && [ "{{ MODE }}" != "auto" ]; then
 	if ! id "${SUDO_USER:-user}" >/dev/null 2>&1; then
diff --git a/tests/install-doc-debian-and-test-hooks b/tests/install-doc-debian-and-test-hooks
index 8b02873..6ad36eb 100644
--- a/tests/install-doc-debian-and-test-hooks
+++ b/tests/install-doc-debian-and-test-hooks
@@ -6,6 +6,8 @@ export SOURCE_DATE_EPOCH={{ SOURCE_DATE_EPOCH }}
 [ {{ VARIANT }} = "custom" ]
 [ {{ MODE }} = "chrootless" ]
 
+trap "rm -rf /tmp/debian-chroot" EXIT INT TERM
+
 prefix=
 if [ "$(id -u)" -eq 0 ] && [ "{{ MODE }}" != "root" ] && [ "{{ MODE }}" != "auto" ]; then
 	if ! id "${SUDO_USER:-user}" >/dev/null 2>&1; then
diff --git a/tests/logfile b/tests/logfile
index 934119d..5e2dbeb 100644
--- a/tests/logfile
+++ b/tests/logfile
@@ -1,6 +1,9 @@
 #!/bin/sh
 set -eu
 export LC_ALL=C.UTF-8
+
+trap "rm -rf /tmp/debian-chroot /tmp/log /tmp/trimmed" EXIT INT TERM
+
 # we check the full log to also prevent debug printfs to accidentally make it into a commit
 {{ CMD }} --mode=root --variant=apt --logfile=/tmp/log {{ DIST }} /tmp/debian-chroot {{ MIRROR }}
 # omit the last line which should contain the runtime
@@ -17,5 +20,3 @@ I: cleaning package lists and apt cache...
 LOG
 tail --lines=1 /tmp/log | grep '^I: success in .* seconds$'
 tar -C /tmp/debian-chroot --one-file-system -c . | tar -t | sort | diff -u tar1.txt -
-rm -r /tmp/debian-chroot
-rm /tmp/log /tmp/trimmed
diff --git a/tests/root-mode-inside-chroot b/tests/root-mode-inside-chroot
index d145773..d4aee20 100644
--- a/tests/root-mode-inside-chroot
+++ b/tests/root-mode-inside-chroot
@@ -6,6 +6,9 @@
 set -eu
 export LC_ALL=C.UTF-8
 [ "$(whoami)" = "root" ]
+
+trap "rm -f /tmp/debian-chroot.tar script.sh" EXIT INT TERM
+
 cat << 'SCRIPT' > script.sh
 #!/bin/sh
 set -eu
@@ -23,4 +26,3 @@ chmod +x script.sh
 	--customize-hook="download /tmp/debian-chroot.tar /tmp/debian-chroot.tar" \
 	{{ DIST }} /dev/null {{ MIRROR }}
 tar -tf /tmp/debian-chroot.tar | sort | diff -u tar1.txt -
-rm /tmp/debian-chroot.tar script.sh
diff --git a/tests/unpack-doc-debian b/tests/unpack-doc-debian
index b51529a..d3c449e 100644
--- a/tests/unpack-doc-debian
+++ b/tests/unpack-doc-debian
@@ -2,6 +2,8 @@
 set -eu
 export LC_ALL=C.UTF-8
 
+trap "rm -rf /tmp/debian-chroot" EXIT INT TERM
+
 [ {{ VARIANT }} = extract ]
 
 prefix=
diff --git a/tests/unshare-include-deb b/tests/unshare-include-deb
index e421d39..2b9c54b 100644
--- a/tests/unshare-include-deb
+++ b/tests/unshare-include-deb
@@ -5,6 +5,8 @@ export LC_ALL=C.UTF-8
 
 [ "{{ MODE }}" = unshare ]
 
+trap "rm -rf /tmp/dummypkg.deb /tmp/dummypkg" EXIT INT TERM
+
 prefix=
 if [ "$(id -u)" -eq 0 ] && [ "{{ MODE }}" != "root" ] && [ "{{ MODE }}" != "auto" ]; then
 	if ! id "${SUDO_USER:-user}" >/dev/null 2>&1; then