diff --git a/.github/actions/after-job/action.yml b/.github/actions/after-job/action.yml
new file mode 100644
index 0000000000..6fba2d7e41
--- /dev/null
+++ b/.github/actions/after-job/action.yml
@@ -0,0 +1,37 @@
+name: 'After-job actions'
+description: >-
+  Perform generic actions that should be performed at the end of every
+  job.
+inputs:
+  jobname:
+    default: ${{ github.job }}
+runs:
+  using: "composite"
+  steps:
+    # collect logs
+    - uses: ./.github/actions/collect-logs
+      if: always()
+      with:
+        jobname: ${{ inputs.jobname }}
+
+    # dirty check
+    - name: "Check that the job didn't change any files"
+      uses: ./.github/actions/git-dirty-check
+      if: ${{ ! failure() }}
+
+    # remote test cluster
+    - run: make ci/teardown-k3d
+      shell: bash
+      if: ${{ ! failure() }}
+
+    # `make clobber`
+    - run: make clobber
+      shell: bash
+      if: ${{ ! failure() }}
+    - name: "Check that `make clobber` didn't change any files"
+      uses: ./.github/actions/git-dirty-check
+      if: ${{ ! failure() }}
+    - name: "Check that `make clobber` did everything it's supposed to"
+      shell: bash
+      run: $GITHUB_ACTION_PATH/check-clobber.sh
+      if: ${{ ! failure() }}
diff --git a/.github/actions/after-job/check-clobber.sh b/.github/actions/after-job/check-clobber.sh
new file mode 100755
index 0000000000..ca24c9cca2
--- /dev/null
+++ b/.github/actions/after-job/check-clobber.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+#shellcheck disable=SC2016
+
+r=0
+if [[ -n "$(git clean --dry-run -d -x)" ]]; then
+    echo
+    echo 'There are files that `make clobber` did not remove that it should have:'
+    git clean --dry-run -d -x | sed 's/^Would remove /    /'
+    echo
+    r=1
+fi
+if docker image list --format='{{ .Repository }}:{{ .Tag }}' | grep -q '\.local/'; then
+    echo
+    echo 'There are Docker images that `make clobber` did not remove that it should have:'
+    docker image list | grep '\.local/'
+    echo
+    r=1
+fi
+if [[ -n "$(docker container list --all --quiet)" ]]; then
+    echo
+    echo 'There are Docker containers that `make clobber` did not remove:'
+    docker container list --all
+    echo
+    r=1
+fi
+if [[ -n "$(docker volume list --quiet)" ]]; then
+    echo
+    echo 'There are Docker volumes that `make clobber` did not remove:'
+    docker volume list
+    echo
+    r=1
+fi
+exit "$r"
diff --git a/.github/workflows/execute-tests-and-promote.yml b/.github/workflows/execute-tests-and-promote.yml
index 2f8f743792..6ecc99dd10 100644
--- a/.github/workflows/execute-tests-and-promote.yml
+++ b/.github/workflows/execute-tests-and-promote.yml
@@ -23,6 +23,8 @@ jobs:
       - shell: bash
         run: |
           make lint
+      - uses: ./.github/actions/after-job
+        if: always()
 
   generate: ####################################################################
     runs-on: ubuntu-latest
@@ -59,6 +61,8 @@ jobs:
           make generate
       - uses: ./.github/actions/git-dirty-check
         name: "Check Git not dirty from 'make generate' (again!)"
+      - uses: ./.github/actions/after-job
+        if: always()
 
   check-envoy-version: #########################################################
     runs-on: ubuntu-latest
@@ -85,6 +89,8 @@ jobs:
           username: ${{ secrets.GH_DOCKER_BUILD_USERNAME }}
           password: ${{ secrets.GH_DOCKER_BUILD_TOKEN }}
       - run: make check-envoy-version
+      - uses: ./.github/actions/after-job
+        if: always()
 
   # Tests ######################################################################
   check-gotest:
@@ -112,9 +118,7 @@ jobs:
           export TEST_XML_DIR=/tmp/test-logs/xml/
           mkdir -p ${TEST_XML_DIR}
           make gotest
-      - uses: ./.github/actions/git-dirty-check
-        name: "Check git not dirty from testing"
-      - uses: ./.github/actions/collect-logs
+      - uses: ./.github/actions/after-job
         if: always()
   check-pytest:
     runs-on: ubuntu-latest
@@ -173,9 +177,7 @@ jobs:
             export DEV_REGISTRY=${{ secrets.DEV_REGISTRY }}
             mkdir -p ${TEST_XML_DIR}
             make pytest-${{ matrix.test }}
-      - uses: ./.github/actions/git-dirty-check
-        name: "Check git not dirty from testing"
-      - uses: ./.github/actions/collect-logs
+      - uses: ./.github/actions/after-job
         if: always()
         with:
           jobname: check-pytest-${{ matrix.test }}
@@ -219,9 +221,7 @@ jobs:
             export DEV_REGISTRY=${{ secrets.DEV_REGISTRY }}
             mkdir -p ${TEST_XML_DIR}
             make pytest-${{ matrix.test }}
-      - uses: ./.github/actions/git-dirty-check
-        name: "Check git not dirty from testing"
-      - uses: ./.github/actions/collect-logs
+      - uses: ./.github/actions/after-job
         if: always()
         with:
           jobname: check-pytest-${{ matrix.test }}
@@ -257,9 +257,7 @@ jobs:
           export DEV_KUBECONFIG=~/.kube/config
 
           make test-chart
-      - uses: ./.github/actions/git-dirty-check
-        name: "Check git not dirty from testing"
-      - uses: ./.github/actions/collect-logs
+      - uses: ./.github/actions/after-job
         if: always()
 
   build: #######################################################################
@@ -293,8 +291,8 @@ jobs:
         shell: bash
         run: |
           make push-dev
-      - uses: ./.github/actions/git-dirty-check
-        name: "Check git not dirty (from make push + make push-dev)"
+      - uses: ./.github/actions/after-job
+        if: always()
 
   ##############################################################################
   pass:
diff --git a/.github/workflows/promote-ga.yml b/.github/workflows/promote-ga.yml
index 680810e20c..462b053442 100644
--- a/.github/workflows/promote-ga.yml
+++ b/.github/workflows/promote-ga.yml
@@ -29,6 +29,8 @@ jobs:
       - name: "make release/promote-oss/to-ga"
         run: |
           make release/promote-oss/to-ga
+      - uses: ./.github/actions/after-job
+        if: always()
       - name: Slack notification
         if: always()
         uses: edge/simple-slack-notify@master
@@ -44,6 +46,8 @@ jobs:
              { "title": "Branch", "value": "${env.GITHUB_REF}", "short": true },
              { "title": "Action URL", "value": "${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}"}
             ]
+      - uses: ./.github/actions/after-job
+        if: always()
   create-gh-release:
     runs-on: ubuntu-latest
     needs: [promote-to-ga]
@@ -78,3 +82,5 @@ jobs:
              { "title": "Branch", "value": "${env.GITHUB_REF}", "short": true },
              { "title": "Action URL", "value": "${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}"}
             ]
+      - uses: ./.github/actions/after-job
+        if: always()
diff --git a/.github/workflows/promote-rc.yml b/.github/workflows/promote-rc.yml
index 18b1b18932..811e28403f 100644
--- a/.github/workflows/promote-rc.yml
+++ b/.github/workflows/promote-rc.yml
@@ -52,3 +52,5 @@ jobs:
              { "title": "Branch", "value": "${env.GITHUB_REF}", "short": true },
              { "title": "Action URL", "value": "${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}"}
             ]
+      - uses: ./.github/actions/after-job
+        if: always()
diff --git a/.github/workflows/publish-chart.yml b/.github/workflows/publish-chart.yml
index 23e2a21acb..10b93dc414 100644
--- a/.github/workflows/publish-chart.yml
+++ b/.github/workflows/publish-chart.yml
@@ -38,6 +38,8 @@ jobs:
              { "title": "Branch", "value": "${env.GITHUB_REF}", "short": true },
              { "title": "Action URL", "value": "${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}"}
             ]
+      - uses: ./.github/actions/after-job
+        if: always()
   chart-create-gh-release:
     if: ${{ ! contains(github.ref, '-') }}
     runs-on: ubuntu-latest
@@ -73,3 +75,5 @@ jobs:
              { "title": "Branch", "value": "${env.GITHUB_REF}", "short": true },
              { "title": "Action URL", "value": "${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}"}
             ]
+      - uses: ./.github/actions/after-job
+        if: always()
diff --git a/.github/workflows/repatriate.yml b/.github/workflows/repatriate.yml
index ac02c13240..7f2ee86f81 100644
--- a/.github/workflows/repatriate.yml
+++ b/.github/workflows/repatriate.yml
@@ -73,3 +73,5 @@ jobs:
             [{ "title": "Repository", "value": "${{ github.repository }}", "short": true },
              { "title": "Branch", "value": "${{ github.ref }}", "short": true},
              { "title": "Pull Request", "value": "${{ steps.step-create-pr.outputs.pr_url }}"}]
+      - uses: ./.github/actions/after-job
+        if: always()
diff --git a/build-aux/ci.mk b/build-aux/ci.mk
index 06a2d8713c..02c6309747 100644
--- a/build-aux/ci.mk
+++ b/build-aux/ci.mk
@@ -11,3 +11,7 @@ ci/setup-k3d: $(tools/k3d) $(tools/kubectl)
 	while ! $(tools/kubectl) get serviceaccount default >/dev/null; do sleep 1; done
 	$(tools/kubectl) version
 .PHONY: ci/setup-k3d
+
+ci/teardown-k3d: $(tools/k3d)
+	$(tools/k3d) cluster delete || true
+.PHONY: ci/teardown-k3d