diff --git a/Makefile b/Makefile
index d270eb771..37e8a65dc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: all deps static clean client-lint client-test client-sync backend frontend shell lint ui-upload
+.PHONY: all deps static clean realclean client-lint client-test client-sync backend frontend shell lint ui-upload
 
 # If you can use Docker without being root, you can `make SUDO= <target>`
 SUDO=$(shell docker info >/dev/null 2>&1 || echo "sudo -E")
@@ -210,11 +210,13 @@ ui-pkg-upload: tmp/weave-scope.tgz
 	AWS_SECRET_ACCESS_KEY=$$UI_BUCKET_KEY_SECRET \
 	aws s3 cp tmp/weave-scope.tgz s3://weaveworks-js-modules/weave-scope/$(shell echo $(SCOPE_VERSION))/weave-scope.tgz
 
+# We don't rmi images here; rm'ing the .uptodate files is enough to
+# get the build images rebuilt, and rm'ing the scope exe is enough to
+# get the main images rebuilt.
+#
+# rmi'ng images is desirable sometimes. Invoke `realclean` for that.
 clean:
 	$(GO) clean ./...
-# Don't actually rmi the build images - rm'ing the .uptodate files is enough to ensure
-# we rebuild the images, and rmi'ing the images causes us to have to redownload a lot of stuff.
-# $(SUDO) docker rmi $(SCOPE_UI_BUILD_IMAGE) $(SCOPE_BACKEND_BUILD_IMAGE) >/dev/null 2>&1 || true
 	rm -rf $(SCOPE_EXPORT) $(SCOPE_UI_BUILD_UPTODATE) $(SCOPE_BACKEND_BUILD_UPTODATE) \
 		$(SCOPE_EXE) $(RUNSVINIT) prog/staticui/staticui.go prog/externalui/externalui.go client/build/*.js client/build-external/*.js docker/weave .pkg \
 		$(CODECGEN_TARGETS) $(CODECGEN_DIR)/bin
@@ -222,6 +224,21 @@ clean:
 clean-codecgen:
 	rm -rf $(CODECGEN_TARGETS) $(CODECGEN_DIR)/bin
 
+# clean + rmi
+#
+# Removal of the main images ensures that a subsequent build rebuilds
+# all their layers, in particular layers installing packages.
+# Crucially, we also remove the *base* images, so their latest
+# versions will be pulled.
+#
+# Doing this is important for release builds.
+realclean: clean
+	$(SUDO) docker rmi -f $(SCOPE_UI_BUILD_IMAGE) $(SCOPE_BACKEND_BUILD_IMAGE) \
+		$(DOCKERHUB_USER)/scope $(DOCKERHUB_USER)/cloud-agent \
+		$(DOCKERHUB_USER)/scope:$(IMAGE_TAG) $(DOCKERHUB_USER)/cloud-agent:$(IMAGE_TAG) \
+		weaveworks/weaveexec:$(WEAVENET_VERSION) \
+		ubuntu:yakkety alpine:3.5 node:6.9.0 2>/dev/null || true
+
 # Dependencies are intentionally build without enforcing any tags
 # since they are build on the host
 deps:
diff --git a/bin/release b/bin/release
index 2de2e7a51..3650c16fc 100755
--- a/bin/release
+++ b/bin/release
@@ -88,7 +88,7 @@ build() {
     ## Inject the version numbers and build the distributables
     ## (library versions?)
     sed -i.tmp "s/SCRIPT_VERSION=\"[^\"]*\"/SCRIPT_VERSION=\"$VERSION\"/" ./scope
-    make SUDO="$SUDO" SCOPE_VERSION="$VERSION" DOCKERHUB_USER="$DOCKERHUB_USER"
+    make SUDO="$SUDO" SCOPE_VERSION="$VERSION" DOCKERHUB_USER="$DOCKERHUB_USER" realclean all
 
     if make tests SUDO="$SUDO"; then
         echo -e '\u2713 Tests pass'