diff --git a/build/build-image/Dockerfile b/build/build-image/Dockerfile
index 9cf839dabfe..f754cf734e8 100644
--- a/build/build-image/Dockerfile
+++ b/build/build-image/Dockerfile
@@ -25,7 +25,11 @@ RUN chmod -R a+rwx /usr/local/go/pkg
 # of operations.
 ENV HOME /go/src/k8s.io/kubernetes
 WORKDIR ${HOME}
-RUN chmod -R a+rwx ${HOME}
+# We have to mkdir the dirs we need, or else Docker will create them when we
+# mount volumes, and it will create them with root-only permissions.  The
+# explicit chmod of _output is required, but I can't really explain why.
+RUN mkdir -p ${HOME} ${HOME}/_output \
+    && chmod -R a+rwx ${HOME} ${HOME}/_output
 
 # Propagate the git tree version into the build image
 ADD kube-version-defs /kube-version-defs
diff --git a/build/common.sh b/build/common.sh
index dd1764e7f41..194cd882f36 100755
--- a/build/common.sh
+++ b/build/common.sh
@@ -64,6 +64,9 @@ readonly LOCAL_OUTPUT_BINPATH="${LOCAL_OUTPUT_SUBPATH}/bin"
 readonly LOCAL_OUTPUT_GOPATH="${LOCAL_OUTPUT_SUBPATH}/go"
 readonly LOCAL_OUTPUT_IMAGE_STAGING="${LOCAL_OUTPUT_ROOT}/images"
 
+# This is a symlink to binaries for "this platform" (e.g. build tools).
+readonly THIS_PLATFORM_BIN="${LOCAL_OUTPUT_ROOT}/bin"
+
 readonly OUTPUT_BINPATH="${CUSTOM_OUTPUT_BINPATH:-$LOCAL_OUTPUT_BINPATH}"
 
 readonly REMOTE_OUTPUT_ROOT="/go/src/${KUBE_GO_PACKAGE}/_output"
@@ -672,6 +675,8 @@ function kube::build::copy_output() {
     kube::log::status "Syncing back _output/dockerized/bin directory from remote Docker"
     rm -rf "${LOCAL_OUTPUT_BINPATH}"
     mkdir -p "${LOCAL_OUTPUT_BINPATH}"
+    rm -f "${THIS_PLATFORM_BIN}"
+    ln -s "${LOCAL_OUTPUT_BINPATH}" "${THIS_PLATFORM_BIN}"
 
     kube::build::destroy_container "${KUBE_BUILD_CONTAINER_NAME}"
     "${docker_cmd[@]}" bash -c "cp -r ${REMOTE_OUTPUT_BINPATH} /tmp/bin;touch /tmp/finished;rm /tmp/bin/test_for_remote;/bin/sleep 600" > /dev/null 2>&1
diff --git a/cluster/kubectl.sh b/cluster/kubectl.sh
index a8758412ab7..8280badff8a 100755
--- a/cluster/kubectl.sh
+++ b/cluster/kubectl.sh
@@ -85,6 +85,7 @@ esac
 # to find the latest one.
 if [[ -z "${KUBECTL_PATH:-}" ]]; then
   locations=(
+    "${KUBE_ROOT}/_output/bin/kubectl"
     "${KUBE_ROOT}/_output/dockerized/bin/${host_os}/${host_arch}/kubectl"
     "${KUBE_ROOT}/_output/local/bin/${host_os}/${host_arch}/kubectl"
     "${KUBE_ROOT}/platforms/${host_os}/${host_arch}/kubectl"
diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
index 1c88348651a..e08b895d87a 100755
--- a/hack/lib/golang.sh
+++ b/hack/lib/golang.sh
@@ -375,6 +375,8 @@ kube::golang::place_bins() {
     local platform_src="/${platform//\//_}"
     if [[ $platform == $host_platform ]]; then
       platform_src=""
+      rm -f "${THIS_PLATFORM_BIN}"
+      ln -s "${KUBE_OUTPUT_BINPATH}/${platform}" "${THIS_PLATFORM_BIN}"
     fi
 
     local full_binpath_src="${KUBE_GOPATH}/bin${platform_src}"
diff --git a/hack/lib/init.sh b/hack/lib/init.sh
index 60baa0b742a..78744e23fc8 100644
--- a/hack/lib/init.sh
+++ b/hack/lib/init.sh
@@ -29,6 +29,9 @@ KUBE_OUTPUT_BINPATH="${KUBE_OUTPUT}/bin"
 # the connections to localhost in scripts will time out
 export no_proxy=127.0.0.1,localhost
 
+# This is a symlink to binaries for "this platform", e.g. build tools.
+THIS_PLATFORM_BIN="${KUBE_ROOT}/_output/bin"
+
 source "${KUBE_ROOT}/hack/lib/util.sh"
 source "${KUBE_ROOT}/cluster/lib/util.sh"
 source "${KUBE_ROOT}/cluster/lib/logging.sh"
diff --git a/hack/lib/util.sh b/hack/lib/util.sh
index 794cd41cd35..529c823bea7 100755
--- a/hack/lib/util.sh
+++ b/hack/lib/util.sh
@@ -168,6 +168,7 @@ kube::util::find-binary() {
   local lookfor="${1}"
   local host_platform="$(kube::util::host_platform)"
   local locations=(
+    "${KUBE_ROOT}/_output/bin/${lookfor}"
     "${KUBE_ROOT}/_output/dockerized/bin/${host_platform}/${lookfor}"
     "${KUBE_ROOT}/_output/local/bin/${host_platform}/${lookfor}"
     "${KUBE_ROOT}/platforms/${host_platform}/${lookfor}"