diff --git a/_in_container_build.sh b/_in_container_build.sh
index cae11b8..2a947a7 100755
--- a/_in_container_build.sh
+++ b/_in_container_build.sh
@@ -1,6 +1,19 @@
 #!/bin/bash
 set -eu
 
+# Re-own bind-mounted outputs to the host caller so artifacts/cache aren't left
+# root-owned on the host. Runs as root inside the container via an EXIT trap so
+# it fires on every exit path. Gated on a non-root HOST_UID, so CI (which may run
+# as root / not set these) is unaffected.
+fix_ownership() {
+  if [ -n "${HOST_UID:-}" ] && [ "${HOST_UID}" != "0" ]; then
+    chown -R "${HOST_UID}:${HOST_GID:-$HOST_UID}" \
+      /output \
+      /app/igloo_driver.tar.gz 2>/dev/null || true
+  fi
+}
+trap fix_ownership EXIT
+
 # Input parameters
 TARGETS="$1"         # Target architectures (space-separated)
 VERSIONS="$2"        # Kernel versions (space-separated)
diff --git a/build.sh b/build.sh
index 94f80b8..586b9e2 100755
--- a/build.sh
+++ b/build.sh
@@ -145,6 +145,7 @@ mkdir -p "$BUILD_OUTPUT_DIR/logs"
 # Run the container with proper environment variables and mounts
 docker run ${INTERACTIVE} --rm \
     -e RELEASE="${RELEASE}" \
+    -e HOST_UID="$(id -u)" -e HOST_GID="$(id -g)" \
     -v $KERNEL_DEVEL_MOUNT_DIR:/kernel-devel:ro \
     -v $PWD:/app \
     -v $BUILD_OUTPUT_DIR:/output \