diff --git a/_in_container_build.sh b/_in_container_build.sh
index d7cef5f..426f29e 100755
--- a/_in_container_build.sh
+++ b/_in_container_build.sh
@@ -2,6 +2,20 @@
 
 set -eu
 
+# Re-own bind-mounted outputs to the host caller so artifacts/cache aren't left
+# root-owned on the host. Runs as root inside the container via an EXIT trap so
+# it covers every exit path (including the early kernel-devel exit). Gated on a
+# non-root HOST_UID, so CI (which may run as root / not set these) is unaffected.
+fix_ownership() {
+  if [ -n "${HOST_UID:-}" ] && [ "${HOST_UID}" != "0" ]; then
+    chown -R "${HOST_UID}:${HOST_GID:-$HOST_UID}" \
+      /tmp/build \
+      /app/kernels-latest.tar.gz \
+      /app/kernel-devel-all.tar.gz 2>/dev/null || true
+  fi
+}
+trap fix_ownership EXIT
+
 # We want to build linux for each of our targets and versions using the config files. Linux is in /app/linux/[version]
 # while our configs are at configs/[version]/[arch]. We need to set the ARCH and CROSS_COMPILE variables
 # and put the binaries in /app/binaries
diff --git a/build.sh b/build.sh
index a9ab6e3..6ae8e11 100755
--- a/build.sh
+++ b/build.sh
@@ -143,6 +143,7 @@ mkdir -p "$CACHE_HOST_DIR"
 docker run $INTERACTIVE \
     --rm -v "$CACHE_HOST_DIR":/tmp/build \
     -v "$PWD":/app \
+    -e HOST_UID="$(id -u)" -e HOST_GID="$(id -g)" \
     $EXTRA_DOCKER_OPTS \
     "$IMAGE" \
     bash /app/_in_container_build.sh \