diff --git a/build-aux/check.mk b/build-aux/check.mk
index cf8deed5769..6b913a08ced 100644
--- a/build-aux/check.mk
+++ b/build-aux/check.mk
@@ -16,6 +16,7 @@ push-pytest-images: docker/kat-server.docker.push.remote
 test_svcs = auth shadow stats
 $(foreach svc,$(test_svcs),docker/.test-$(svc).docker.stamp): docker/.%.docker.stamp: docker/%/Dockerfile FORCE
 	docker build --iidfile=$@ $(<D)
+clean: $(foreach svc,$(test_svcs),docker/test-$(svc).docker.clean)
 
 # kat-client.docker
 docker/kat-client.go.layer.tar: $(tools/ocibuild) $(tools/write-ifchanged) FORCE
@@ -53,6 +54,7 @@ docker/.kat-server.img.tar.stamp: $(tools/ocibuild) docker/base.img.tar docker/k
 	  --config.Cmd='kat-server' \
 	  --tag=emissary.local/kat-server:latest \
 	  <($(tools/ocibuild) layer squash $(filter %.layer.tar,$^)); } > $@
+docker/kat-server.img.tar.clean: docker/kat-server.rm-r
 
 #
 # Helm tests
@@ -63,6 +65,7 @@ test-chart-values.yaml: docker/emissary.docker.push.remote
 	  sed -E -n '2s/^(.*):.*/  repository: \1/p' < $<; \
 	  sed -E -n '2s/.*:/  tag: /p' < $<; \
 	} >$@
+clean: test-chart-values.yaml.rm
 build-output/chart-%/ci: build-output/chart-% test-chart-values.yaml
 	rm -rf $@
 	cp -a $@.in $@
@@ -77,3 +80,8 @@ endif
 	$(tools/kubectl) --kubeconfig=$(DEV_KUBECONFIG) --namespace=emissary-system wait --timeout=90s --for=condition=available Deployments/emissary-apiext
 	cd $(chart_dir) && KUBECONFIG=$(DEV_KUBECONFIG) $(abspath $(tools/ct)) install --config=./ct.yaml
 .PHONY: test-chart
+
+#
+# Other
+
+clean: .pytest_cache.rm-r .coverage.rm
diff --git a/build-aux/docker.mk b/build-aux/docker.mk
index 9a9bfe337b6..be25e17575a 100644
--- a/build-aux/docker.mk
+++ b/build-aux/docker.mk
@@ -220,8 +220,7 @@ docker.LOCALHOST = $(if $(filter darwin,$(GOHOSTOS)),host.docker.internal,localh
 
 %.docker.clean: $(addprefix %.docker.clean.,$(_docker.clean.groups))
 	if [ -e $*.docker ]; then docker image rm "$$(cat $*.docker)" || true; fi
-# It "shouldn't" need the ".*" suffix, but it makes it easier to hook in with things like a .stamp file
-	rm -f $*.docker $*.docker.*
+	rm -f $*.docker $(*D)/.$(*F).docker.stamp
 .PHONY: %.docker.clean
 
 # Evaluate _docker.tag.rule with _docker.tag.group=TAG_GROUPNAME for
diff --git a/build-aux/generate.mk b/build-aux/generate.mk
index 1ef9aec9f4b..30d1fd8ec33 100644
--- a/build-aux/generate.mk
+++ b/build-aux/generate.mk
@@ -366,12 +366,14 @@ $(OSS_HOME)/k8s-config/%/helm-expanded.yaml: \
   $(OSS_HOME)/k8s-config/%/values.yaml \
   $(boguschart_dir)
 	helm template --namespace=$(helm.namespace.$*) --values=$(@D)/values.yaml $(or $(helm.name.$*),$*) $(boguschart_dir) >$@
-
 $(OSS_HOME)/k8s-config/%/output.yaml: \
   $(OSS_HOME)/k8s-config/%/helm-expanded.yaml \
   $(OSS_HOME)/k8s-config/%/require.yaml \
   $(tools/filter-yaml)
 	$(tools/filter-yaml) $(filter %/helm-expanded.yaml,$^) $(filter %/require.yaml,$^) >$@
+k8s-config.clean:
+	rm -f k8s-config/*/helm-expanded.yaml k8s-config/*/output.yaml
+clean: k8s-config.clean
 
 $(OSS_HOME)/manifests/emissary/%.yaml.in: $(OSS_HOME)/k8s-config/%/output.yaml
 	cp $< $@
@@ -390,14 +392,21 @@ $(OSS_HOME)/python/tests/integration/manifests/rbac_namespace_scope.yaml: $(OSS_
 
 $(OSS_HOME)/build-aux/pip-show.txt: docker/base-pip.docker.tag.local
 	docker run --rm "$$(cat docker/base-pip.docker)" sh -c 'pip freeze --exclude-editable | cut -d= -f1 | xargs pip show' > $@
+clean: build-aux/pip-show.txt.rm
 
 $(OSS_HOME)/build-aux/go-version.txt: docker/base-python/Dockerfile
 	sed -En 's,.*https://dl\.google\.com/go/go([0-9a-z.-]*)\.linux-amd64\.tar\.gz.*,\1,p' < $< > $@
+clean: build-aux/go-version.txt.rm
+
 $(OSS_HOME)/build-aux/py-version.txt: docker/base-python/Dockerfile
 	{ grep -o 'python3=\S*' | cut -d= -f2; } < $< > $@
+clean: build-aux/py-version.txt.rm
 
 $(OSS_HOME)/build-aux/go1%.src.tar.gz:
 	curl -o $@ --fail -L https://dl.google.com/go/$(@F)
+build-aux/go.src.tar.gz.clean:
+	rm -f build-aux/go1*.src.tar.gz
+clobber: build-aux/go.src.tar.gz.clean
 
 $(OSS_HOME)/DEPENDENCIES.md: $(tools/go-mkopensource) $(tools/py-mkopensource) $(OSS_HOME)/build-aux/go-version.txt $(OSS_HOME)/build-aux/pip-show.txt
 	$(MAKE) $(OSS_HOME)/build-aux/go$$(cat $(OSS_HOME)/build-aux/go-version.txt).src.tar.gz
diff --git a/build-aux/lint.mk b/build-aux/lint.mk
index 49329f2334e..d1c1a11e086 100644
--- a/build-aux/lint.mk
+++ b/build-aux/lint.mk
@@ -22,6 +22,7 @@ lint:
 		exit $$r; \
 	}
 .PHONY: lint
+clean: .dmypy.json.rm .mypy_cache.rm-r
 
 golint: $(tools/golangci-lint)
 	@PS4=; set -x; r=0; { \
diff --git a/build-aux/main.mk b/build-aux/main.mk
index f5d5caa6ee6..e1665e93a10 100644
--- a/build-aux/main.mk
+++ b/build-aux/main.mk
@@ -14,6 +14,9 @@ include build-aux/var.mk
 %.rm:
 	rm -f $*
 .PHONY: %.rm
+%.rm-r:
+	rm -rf $*
+.PHONY: %.rm-r
 
 # For files that should only-maybe update when the rule runs, put ".stamp" on
 # the left-side of the ":", and just go ahead and update it within the rule.
@@ -33,6 +36,10 @@ _ocibuild-images += kat-server
 $(foreach img,$(_ocibuild-images),docker/.$(img).docker.stamp): docker/.%.docker.stamp: docker/%.img.tar
 	docker load < $<
 	docker inspect $$(bsdtar xfO $< manifest.json|jq -r '.[0].RepoTags[0]') --format='{{.Id}}' > $@
+clean: $(foreach img,$(_ocibuild-images),docker/$(img).img.tar.clean)
+
+%.img.tar.clean: %.docker.clean
+	rm -f $*.img.tar $(*D)/.$(*F).img.tar.stamp $(*D)/$(*F).*.layer.tar
 
 #
 # Specific rules
@@ -48,6 +55,7 @@ $(foreach img,$(_ocibuild-images),docker/.$(img).docker.stamp): docker/.%.docker
 # that don't need Emissary-specif stuff.
 docker/.base.img.tar.stamp: FORCE $(tools/crane) docker/base-python/Dockerfile
 	$(tools/crane) pull $(shell gawk '$$1 == "FROM" { print $$2; quit; }' < docker/base-python/Dockerfile) $@ || test -e $@
+clobber: docker/base.img.tar.clean
 
 # base-python: Base OS, plus some Emissary-specific setup of
 # low-level/expensive pieces of the Python environment.  This does NOT
@@ -63,6 +71,7 @@ docker/.base.img.tar.stamp: FORCE $(tools/crane) docker/base-python/Dockerfile
 # (`apk add`, libc-specific compilation...).
 docker/.base-python.docker.stamp: FORCE docker/base-python/Dockerfile docker/base-python.docker.gen
 	docker/base-python.docker.gen >$@
+clobber: docker/base-python.docker.clean
 
 # base-pip: base-python, but with requirements.txt installed.
 #
@@ -77,19 +86,23 @@ docker/.base-python.docker.stamp: FORCE docker/base-python/Dockerfile docker/bas
 #	$(tools/py-list-deps) --include-dev python/ | $(tools/write-ifchanged) $@
 python/requirements.in: $(tools/py-list-deps) $(tools/write-ifchanged) FORCE
 	set -o pipefail; $(tools/py-list-deps) --no-include-dev python/ | $(tools/write-ifchanged) $@
+clean: python/requirements.in.rm
 python/.requirements.txt.stamp: python/requirements.in docker/base-python.docker.tag.local
 # The --interactive is so that stdin gets passed through; otherwise Docker closes stdin.
 	set -ex -o pipefail; { \
 	  docker run --platform="$(BUILD_ARCH)" --rm --interactive "$$(cat docker/base-python.docker)" sh -c 'tar xf - && find ~/.cache/pip -name "maturin-*.whl" -exec pip install --no-deps {} + >&2 && pip-compile --allow-unsafe --no-build-isolation -q >&2 && cat requirements.txt' \
 	    < <(bsdtar -cf - -C $(@D) requirements.in requirements.txt) \
 	    > $@; }
+clean: python/.requirements.txt.stamp.rm
 python/requirements.txt: python/%: python/.%.stamp $(tools/copy-ifchanged)
 	$(tools/copy-ifchanged) $< $@
 .PRECIOUS: python/requirements.txt
 docker/base-pip/requirements.txt: python/requirements.txt $(tools/copy-ifchanged)
 	$(tools/copy-ifchanged) $< $@
+clean: docker/base-pip/requirements.txt.rm
 docker/.base-pip.docker.stamp: docker/.%.docker.stamp: docker/%/Dockerfile docker/%/requirements.txt docker/base-python.docker.tag.local
 	docker build --platform="$(BUILD_ARCH)" --build-arg=from="$$(sed -n 2p docker/base-python.docker.tag.local)" --iidfile=$@ $(<D)
+clobber: docker/base-pip.docker.clean
 
 # The Helm chart
 build-output/chart-%.d: \
@@ -171,3 +184,18 @@ endif
 	$(foreach src,$(filter %.yaml,$^),$(foreach dst,$(patsubst docs/yaml/%,$@/%,$(src)),\
 	  mkdir -p $(dir $(dst))$(NL)\
 	  sed -e 's/\$$version\$$/$*/g' -e 's/\$$quoteVersion$$/0.4.1/g' <$(src) >$(dst)$(NL)))
+
+#
+# Destructive rules
+
+clobber: clean
+
+clean: build-output.rm-r
+
+python.clean: %.clean: python/ambassador.egg-info.rm-r
+	find $* -name __pycache__ -exec rm -rf -- {} +
+clean: python.clean
+
+cmd.clean pkg.clean: %.clean:
+	find $* -name '*.yaml.o' -delete
+clean: cmd.clean pkg.clean
diff --git a/builder/builder.mk b/builder/builder.mk
index 76507448649..06e1c5766d9 100644
--- a/builder/builder.mk
+++ b/builder/builder.mk
@@ -205,6 +205,7 @@ python/ambassador.version: $(tools/write-ifchanged) FORCE
 	  echo $(patsubst v%,%,$(VERSION)); \
 	  git rev-parse HEAD; \
 	} | $(tools/write-ifchanged) $@
+clean: python/ambassador.version.rm
 
 # Give Make a hint about which pattern rules to apply.  Honestly, I'm
 # not sure why Make isn't figuring it out on its own, but it isn't.
@@ -224,6 +225,8 @@ docker/.base-envoy.docker.stamp: FORCE
 	  fi; \
 	  echo $(ENVOY_DOCKER_TAG) >$@; \
 	}
+clobber: docker/base-envoy.docker.clean
+
 docker/.$(LCNAME).docker.stamp: %/.$(LCNAME).docker.stamp: %/base.docker.tag.local %/base-envoy.docker.tag.local %/base-pip.docker.tag.local python/ambassador.version $(BUILDER_HOME)/Dockerfile $(OSS_HOME)/build-aux/py-version.txt $(tools/dsum) FORCE
 	@printf "${CYN}==> ${GRN}Building image ${BLU}$(LCNAME)${END}\n"
 	@printf "    ${BLU}base=$$(sed -n 2p $*/base.docker.tag.local)${END}\n"
@@ -237,6 +240,7 @@ docker/.$(LCNAME).docker.stamp: %/.$(LCNAME).docker.stamp: %/base.docker.tag.loc
 	    --build-arg=builderbase="$$(sed -n 2p $*/base-pip.docker.tag.local)" \
 	    --build-arg=py_version="$$(cat build-aux/py-version.txt)" \
 	    --iidfile=$@; }
+clean: docker/$(LCNAME).docker.clean
 
 REPO=$(BUILDER_NAME)
 
@@ -328,6 +332,7 @@ build-aux/.pytest-kat.txt.stamp: $(OSS_HOME)/venv push-pytest-images FORCE
 	. venv/bin/activate && set -o pipefail && pytest --collect-only python/tests/kat 2>&1 | sed -En 's/.*<Function (.*)>/\1/p' | sed 's/[].].*//' | sort -u > $@
 build-aux/pytest-kat.txt: build-aux/%: build-aux/.%.stamp $(tools/copy-ifchanged)
 	$(tools/copy-ifchanged) $< $@
+clean: build-aux/.pytest-kat.txt.stamp.rm build-aux/pytest-kat.txt.rm
 pytest-kat-envoy3-g%: build-aux/pytest-kat.txt $(tools/py-split-tests)
 	$(MAKE) pytest KAT_RUN_MODE=envoy PYTEST_ARGS="$$PYTEST_ARGS -k '$$($(tools/py-split-tests) $* 3 <build-aux/pytest-kat.txt)' python/tests/kat"
 pytest-kat-envoy2: push-pytest-images # doing this all at once is too much for CI...
@@ -374,6 +379,7 @@ $(OSS_HOME)/venv: python/requirements.txt python/requirements-dev.txt
 	$@/bin/pip3 install -r python/requirements.txt
 	$@/bin/pip3 install -r python/requirements-dev.txt
 	$@/bin/pip3 install -e $(OSS_HOME)/python
+clobber: venv.rm-r
 
 GOTEST_ARGS ?= -race -count=1 -timeout 30m
 GOTEST_ARGS += -parallel=150 # The ./pkg/envoy-control-plane/cache/v{2,3}/ tests require high parallelism to reliably work