diff --git a/hack/lib/golang.sh b/hack/lib/golang.sh
index 38663df0338..fb236f93a1b 100755
--- a/hack/lib/golang.sh
+++ b/hack/lib/golang.sh
@@ -18,7 +18,8 @@
 
 # The golang package that we are building.
 readonly KUBE_GO_PACKAGE=k8s.io/kubernetes
-readonly KUBE_GOPATH="${KUBE_OUTPUT}/go"
+readonly KUBE_GOPATH="${KUBE_GOPATH:-"${KUBE_OUTPUT}/go"}"
+export KUBE_GOPATH
 
 # The server platform we are building on.
 readonly KUBE_SUPPORTED_SERVER_PLATFORMS=(
diff --git a/hack/update-mocks.sh b/hack/update-mocks.sh
index 7ab7f2e3412..ce1601a5c5a 100755
--- a/hack/update-mocks.sh
+++ b/hack/update-mocks.sh
@@ -26,16 +26,6 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 # Explicitly opt into go modules, even though we're inside a GOPATH directory
 export GO111MODULE=on
 
-_tmp="${KUBE_ROOT}/_tmp_build_tag_files"
-mkdir -p "${_tmp}"
-
-function cleanup {
-    rm -rf "$_tmp"
-    rm -f "tempfile"
-}
-
-trap cleanup EXIT
-
 kube::golang::verify_go_version
 kube::golang::setup_env
 
@@ -45,22 +35,26 @@ pushd "${KUBE_ROOT}/hack/tools" >/dev/null
 popd >/dev/null
 
 function git_find() {
-    # Similar to find but faster and easier to understand.  We want to include
-    # modified and untracked files because this might be running against code
-    # which is not tracked by git yet.
-    git ls-files -cmo --exclude-standard \
-        ':!:vendor/*'        `# catches vendor/...` \
-        ':!:*/vendor/*'      `# catches any subdir/vendor/...` \
-        ':!:third_party/*'   `# catches third_party/...` \
-        ':!:*/third_party/*' `# catches third_party/...` \
-        ':!:*/testdata/*' \
-        "$@"
+  # Similar to find but faster and easier to understand.  We want to include
+  # modified and untracked files because this might be running against code
+  # which is not tracked by git yet.
+  git ls-files -cmo --exclude-standard \
+      ':!:vendor/*'        `# catches vendor/...` \
+      ':!:*/vendor/*'      `# catches any subdir/vendor/...` \
+      ':!:third_party/*'   `# catches third_party/...` \
+      ':!:*/third_party/*' `# catches third_party/...` \
+      ':!:*/testdata/*' \
+      "$@"
 }
 
 cd "${KUBE_ROOT}"
 
 GENERATED_MOCK_FILE_REGEX="^// Code generated by MockGen. DO NOT EDIT.$"
 
+# pick a tempfile path for writing to
+tmp=$(mktemp)
+kube::util::trap_add "rm -f ${tmp:?}" EXIT
+
 # We use this pattern here rather than `git grep` because we don't really want
 # to encode the pathspec list in multiple places and anything more complicated
 # just isn't worth the effort.
@@ -112,7 +106,7 @@ git ls-files -mo --exclude-standard -z | while read -r -d $'\0' file; do
     new_header=$(echo -e "//""$go_build_tag_string""\n""//" "$build_tag_string""\n" | cat - hack/boilerplate/boilerplate.generatego.txt)
 
     # ignore the first line (build tag) from the file
-    tail -n +3 "$file" > tempfile
+    tail -n +3 "$file" >"${tmp}"
   fi
 
   # if the file has only // +build !providerless header
@@ -122,7 +116,7 @@ git ls-files -mo --exclude-standard -z | while read -r -d $'\0' file; do
     new_header=$(echo -e "//" "$build_tag_string""\n" | cat - hack/boilerplate/boilerplate.generatego.txt)
 
     # ignore the first line (build tag) from the file
-    tail -n +2 "$file" > tempfile
+    tail -n +2 "$file" >"${tmp}"
   fi
 
   # if the file has only //go:build !providerless header
@@ -132,17 +126,17 @@ git ls-files -mo --exclude-standard -z | while read -r -d $'\0' file; do
     new_header=$(echo -e "//""$go_build_tag_string""\n" | cat - hack/boilerplate/boilerplate.generatego.txt)
 
     # ignore the first line (build tag) from the file
-    tail -n +2 "$file" > tempfile
+    tail -n +2 "$file" >"${tmp}"
   fi
 
   # if the header is generated
   if [ -n "$new_header" ]
   then
     # write the newly generated header file to the original file
-    echo -e "$new_header" | cat - tempfile > "$file"
+    echo -e "$new_header" | cat - "${tmp}" > "$file"
   else
     # if no build string insert at the top
-    cat hack/boilerplate/boilerplate.generatego.txt "$file" > tempfile && \
-    mv tempfile "$file"
+    cat hack/boilerplate/boilerplate.generatego.txt "$file" >"${tmp}" && \
+    mv "${tmp}" "$file"
   fi
 done
diff --git a/hack/update-yamlfmt.sh b/hack/update-yamlfmt.sh
index e3c36e16155..ca784eb3997 100755
--- a/hack/update-yamlfmt.sh
+++ b/hack/update-yamlfmt.sh
@@ -21,7 +21,7 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 
 cd "${KUBE_ROOT}"
 
diff --git a/hack/verify-internal-modules.sh b/hack/verify-internal-modules.sh
index 8ec9678e17f..9b2bef3824e 100755
--- a/hack/verify-internal-modules.sh
+++ b/hack/verify-internal-modules.sh
@@ -22,9 +22,11 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::util::ensure_clean_working_dir
+# This sets up the environment, like GOCACHE, which keeps the worktree cleaner.
+kube::golang::setup_env
 
 _tmpdir="$(kube::realpath "$(mktemp -d -t verify-internal-modules.XXXXXX)")"
-#kube::util::trap_add "rm -rf ${_tmpdir}" EXIT
+kube::util::trap_add "rm -rf ${_tmpdir:?}" EXIT
 
 _tmp_gopath="${_tmpdir}/go"
 _tmp_kuberoot="${_tmp_gopath}/src/k8s.io/kubernetes"
diff --git a/hack/verify-licenses.sh b/hack/verify-licenses.sh
index 0987e714ea3..a8907a5d5e5 100755
--- a/hack/verify-licenses.sh
+++ b/hack/verify-licenses.sh
@@ -27,7 +27,8 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 source "${KUBE_ROOT}/hack/lib/util.sh"
 
 
-kube::golang::verify_go_version
+# This sets up the environment, like GOCACHE, which keeps the worktree cleaner.
+kube::golang::setup_env
 kube::util::ensure-temp-dir
 
 
diff --git a/hack/verify-mocks.sh b/hack/verify-mocks.sh
index 07452c7e7db..4fa0db12237 100755
--- a/hack/verify-mocks.sh
+++ b/hack/verify-mocks.sh
@@ -31,6 +31,8 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 export GO111MODULE=on
 
 kube::util::ensure_clean_working_dir
+# This sets up the environment, like GOCACHE, which keeps the worktree cleaner.
+kube::golang::setup_env
 
 _tmpdir="$(kube::realpath "$(mktemp -d -t "$(basename "$0").XXXXXX")")"
 git worktree add -f -q "${_tmpdir}" HEAD
diff --git a/hack/verify-yamlfmt.sh b/hack/verify-yamlfmt.sh
index cea2c7edde3..284b318fe24 100755
--- a/hack/verify-yamlfmt.sh
+++ b/hack/verify-yamlfmt.sh
@@ -28,6 +28,8 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
 kube::util::ensure_clean_working_dir
+# This sets up the environment, like GOCACHE, which keeps the worktree cleaner.
+kube::golang::setup_env
 
 _tmpdir="$(kube::realpath "$(mktemp -d -t "$(basename "$0").XXXXXX")")"
 git worktree add -f -q "${_tmpdir}" HEAD