diff --git a/tools/packaging/static-build/qemu/build-qemu.sh b/tools/packaging/static-build/qemu/build-qemu.sh
index 865e346ee6..d08d21f04f 100755
--- a/tools/packaging/static-build/qemu/build-qemu.sh
+++ b/tools/packaging/static-build/qemu/build-qemu.sh
@@ -26,11 +26,10 @@ HYPERVISOR_NAME="${HYPERVISOR_NAME:-}"
 PREFIX="${PREFIX:-}"
 PKGVERSION=${PKGVERSION:-}
 
-# This script always runs inside a dedicated build container (see
-# static-build/qemu/Dockerfile), so rm -rf of a relative path is safe.
-rm -rf qemu
-git clone --depth=1 "${QEMU_REPO}" qemu
-pushd qemu
+workdir="$(mktemp -d)"
+trap 'rm -rf "${workdir}"' EXIT
+git clone --depth=1 "${QEMU_REPO}" "${workdir}/qemu"
+pushd "${workdir}/qemu"
 git fetch --depth=1 origin "${QEMU_VERSION_NUM}"
 git checkout FETCH_HEAD
 scripts/git-submodule.sh update meson capstone