diff --git a/.gitignore b/.gitignore
index 90d02a4..2a899d5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,10 +1,8 @@
 # SPDX-License-Identifier: CC0-1.0
 # SPDX-FileCopyrightText: none
+
 /image/
 /version
-/*.raw
-/*.tar
-/*.efi
 /pacman-cache/
 /systemdOS_*/
 /kde-builder/
@@ -13,7 +11,6 @@
 /upload-vacuum/vendor/
 
 mkosi.local.conf
-
-kde-linux_*
-/mkosi.sandbox/etc/pacman.conf
-/mkosi.sandbox/etc/pacman.d/mirrorlist
+mkosi.output
+mkosi.sandbox/etc/pacman.conf
+mkosi.sandbox/etc/pacman.d/mirrorlist
diff --git a/build.sh b/build.sh
index 75ef33f..31873a8 100755
--- a/build.sh
+++ b/build.sh
@@ -10,7 +10,7 @@
 set -ex
 
 VERSION=$(date +%Y%m%d%H%M) # Build version, will just be YYYYmmddHHMM for now
-OUTPUT=kde-linux_$VERSION   # Built rootfs path (mkosi uses this directory by default)
+OUTPUT=mkosi.output/kde-linux_$VERSION   # Built rootfs path (mkosi uses this directory by default)
 
 # Canonicalize the path in $OUTPUT to avoid any possible path issues.
 OUTPUT="$(readlink --canonicalize-missing "$OUTPUT")"
@@ -24,7 +24,8 @@ IMG=${OUTPUT}.raw                        # Output raw image path
 EFI=kde-linux_${VERSION}+3.efi # Name of primary UKI in the image's ESP
 
 # Clean up old build artifacts.
-rm --recursive --force kde-linux.cache/*.raw kde-linux.cache/*.mnt
+rm --recursive --force mkosi.output kde-linux.cache/*.raw kde-linux.cache/*.mnt
+mkdir mkosi.output
 
 export SYSTEMD_LOG_LEVEL=debug
 
@@ -37,7 +38,6 @@ mkosi \
     --environment="CI_PIPELINE_URL=${CI_PIPELINE_URL:-https://invent.kde.org}" \
     --image-version="$VERSION" \
     --package-cache-dir=/var/cache/mkosi.pacman \
-    --output-directory=. \
     "$@"
 
 # Create a directory structure for the UKIs.
@@ -168,7 +168,7 @@ truncate --size=-$SHRINK_SIZE root.raw
 cd ..
 
 # Create rootfs tarball for consumption by systemd-sysext (doesn't currently support consuming raw images :()
-rm -rf "$ROOTFS_TAR" ./*.tar
+rm -rf "$ROOTFS_TAR"
 tar -C "${OUTPUT}"/ --xattrs --xattrs-include=*.* -cf "$ROOTFS_TAR" .
 zstd -T0 --rm "$ROOTFS_TAR"
 
@@ -182,5 +182,5 @@ systemd-repart --no-pager --empty=allow --size=auto --dry-run=no --root=kde-linu
 # TODO before accepting new uploads perform sanity checks on the artifacts (e.g. the tar being well formed)
 
 # efi images and torrents are 700, make them readable so the server can serve them
-chmod go+r "$OUTPUT".* ./*.efi ./*.torrent
-ls -lah
+chmod go+r "$OUTPUT"
+ls -lah . mkosi.output
diff --git a/upload.sh b/upload.sh
index 6af9a94..de0f015 100755
--- a/upload.sh
+++ b/upload.sh
@@ -27,12 +27,12 @@ echo "origin.files.kde.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILUjdH4S7otYIdLUk
 
 # More readable this way, ignore shellcheck
 # shellcheck disable=SC2129
-sha256sum -- *.efi >> SHA256SUMS
-sha256sum -- *.raw >> SHA256SUMS
-sha256sum -- *.tar.zst >> SHA256SUMS
-sha256sum -- *.torrent >> SHA256SUMS
+sha256sum -- mkosi.output/*.efi >> SHA256SUMS
+sha256sum -- mkosi.output/*.raw >> SHA256SUMS
+sha256sum -- mkosi.output/*.tar.zst >> SHA256SUMS
+sha256sum -- mkosi.output/*.torrent >> SHA256SUMS
 
 gpg --homedir="$GNUPGHOME" --output SHA256SUMS.gpg --detach-sign SHA256SUMS
 
-scp -i "$SSH_IDENTITY" ./*.efi ./*.raw ./*.tar.zst ./*.torrent "$REMOTE"
+scp -i "$SSH_IDENTITY" mkosi.output/*.efi mkosi.output/*.raw mkosi.output/*.tar.zst mkosi.output/*.torrent "$REMOTE"
 scp -i "$SSH_IDENTITY" SHA256SUMS SHA256SUMS.gpg "$REMOTE" # upload as last artifact to finalize the upload