diff --git a/cmd/release/release.go b/cmd/release/release.go
index 53844bd..ddfa4cf 100644
--- a/cmd/release/release.go
+++ b/cmd/release/release.go
@@ -499,7 +499,7 @@
 		return err
 	}
 
-	cleanFiles := []string{"releaselet.go", goPath, go14}
+	cleanFiles := []string{"releaselet.go", goPath, go14, "tmp", "gocache"}
 
 	switch b.OS {
 	case "darwin":
@@ -523,12 +523,35 @@
 		return err
 	}
 
+	// And verify there's no other top-level stuff besides the "go" directory:
+	if err := checkTopLevelDirs(client); err != nil {
+		return fmt.Errorf("verifying no unwanted top-level directories: %v", err)
+	}
+
 	if b.OS == "windows" {
 		return b.fetchZip(client)
 	}
 	return b.fetchTarball(client)
 }
 
+// checkTopLevelDirs checks that all files under client's "."
+// ($WORKDIR) are are under "go/".
+func checkTopLevelDirs(client *buildlet.Client) error {
+	var badFileErr error // non-nil once an unexpected file/dir is found
+	if err := client.ListDir(".", buildlet.ListDirOpts{Recursive: true}, func(ent buildlet.DirEntry) {
+		if badFileErr != nil {
+			return
+		}
+		name := ent.Name()
+		if !(strings.HasPrefix(name, "go/") || strings.HasPrefix(name, `go\`)) {
+			badFileErr = fmt.Errorf("unexpected filename %q found after cleaning", name)
+		}
+	}); err != nil {
+		return err
+	}
+	return badFileErr
+}
+
 func (b *Build) fetchTarball(client *buildlet.Client) error {
 	b.logf("Downloading tarball.")
 	tgz, err := client.GetTar(context.Background(), ".")