diff --git a/Makefile b/Makefile
index be9b0b6f4..f00039f0b 100644
--- a/Makefile
+++ b/Makefile
@@ -174,6 +174,9 @@ ui-build-pkg:
 
 clean:
 	$(GO) clean ./...
+	# build-external was accidentially created as owned by root in earlier versions. This is fixed now,
+	# but we need to fix up old checkouts, since git doesn't track ownership.
+	if [ "$$(stat -c %%U client/build-external)" == "root" ]; then sudo chown "$$USER:$$USER" client/build-external; fi
 	# Don't actually rmi the build images - rm'ing the .uptodate files is enough to ensure
 	# we rebuild the images, and rmi'ing the images causes us to have to redownload a lot of stuff.
 	# $(SUDO) docker rmi $(SCOPE_UI_BUILD_IMAGE) $(SCOPE_BACKEND_BUILD_IMAGE) >/dev/null 2>&1 || true
diff --git a/client/build-external/.gitignore b/client/build-external/.gitignore
new file mode 100644
index 000000000..a4b63e4d7
--- /dev/null
+++ b/client/build-external/.gitignore
@@ -0,0 +1 @@
+# this file is only present to force git to create this directory in the working tree