diff --git a/Containerfile b/Containerfile
index b99476a..984a7f9 100644
--- a/Containerfile
+++ b/Containerfile
@@ -30,6 +30,8 @@ RUN --mount=type=bind,from=ctx,source=/,target=/ctx \
   --mount=type=tmpfs,dst=/tmp \
   /ctx/build.sh
 
+RUN /ctx/cleanup.sh
+
 ### LINTING
 ## Verify final image and contents are correct.
 RUN bootc container lint
diff --git a/build_files/build.sh b/build_files/build.sh
index c72181c..6ed6eee 100755
--- a/build_files/build.sh
+++ b/build_files/build.sh
@@ -122,68 +122,6 @@ systemctl enable tailscaled
 # Remove dnf5 versionlocks
 dnf5 versionlock clear
 
-## Handle files that rpm-ostree would normally remove
-## Borrowed from: https://github.com/hhd-dev/rechunk/blob/master/1_prune.sh#L33
-if [ -f /etc/passwd ]; then
-  echo
-  echo Appending the following passwd users to /usr/lib/passwd
-  out=$(grep -v "root" /etc/passwd)
-  echo "$out"
-  echo "$out" >>/usr/lib/passwd
-fi
-if [ -f /etc/group ]; then
-  echo
-  echo Appending the following group entries to /usr/lib/group
-  out=$(grep -v "root\|wheel" /etc/group)
-  echo "$out"
-  echo "$out" >>/usr/lib/group
-fi
-
-if [ -f /etc/passwd ] || [ -f /etc/group ]; then
-  echo
-  echo "Warning: Make sure processed users and groups are from installed programs!"
-fi
-
-# # Create defaults for /etc/passwd, /etc/group
-# cat <<EOT >/etc/passwd
-# root:x:0:0:root:/root:/bin/bash
-# EOT
-# cat <<EOT >/etc/group
-# root:x:0:
-# wheel:x:10:
-# EOT
-
-# Extra lock files created by container processes that might cause issues
-rm -rf \
-  /etc/.pwd.lock \
-  /etc/passwd- \
-  /etc/group- \
-  /etc/shadow- \
-  /etc/gshadow- \
-  /etc/subuid- \
-  /etc/subgid- \
-  /.dockerenv
-
-# # Merge /usr/etc to /etc
-# # OSTree will error out if both dirs exist
-# # And rpm-ostree will be confused and use only one of them
-# if [ -d /usr/etc ]; then
-#   echo
-#   echo WARNING: FOUND /usr/etc. MERGING TO ETC FOR COMPATIBILITY
-#   echo EXPECT PERMISSIONS ISSUES ON THE MERGED PATHS
-#   echo The following files from /usr/etc will be merged to /etc:
-#   tree /usr/etc
-#
-#   echo
-#   rsync -aAX --numeric-ids --checksum --links /usr/etc/ /etc
-#   rm -rf /usr/etc
-# fi
-#
-# # Move /etc to /usr/etc
-# mv /etc /usr/
-
-# ...normal ublue-inspired steps continue.
-
 # Remove tmp files and everything in dirs that make bootc unhappy
 rm -rf /tmp/* || true
 rm -rf /usr/etc
diff --git a/build_files/cleanup.sh b/build_files/cleanup.sh
new file mode 100755
index 0000000..f38b0fc
--- /dev/null
+++ b/build_files/cleanup.sh
@@ -0,0 +1,65 @@
+#!/bin/bash
+
+set -ouex pipefail
+
+## Handle files that rpm-ostree would normally remove
+## Borrowed from: https://github.com/hhd-dev/rechunk/blob/master/1_prune.sh#L33
+if [ -f /etc/passwd ]; then
+  echo
+  echo Appending the following passwd users to /usr/lib/passwd
+  out=$(grep -v "root" /etc/passwd)
+  echo "$out"
+  echo "$out" >>/usr/lib/passwd
+fi
+if [ -f /etc/group ]; then
+  echo
+  echo Appending the following group entries to /usr/lib/group
+  out=$(grep -v "root\|wheel" /etc/group)
+  echo "$out"
+  echo "$out" >>/usr/lib/group
+fi
+
+if [ -f /etc/passwd ] || [ -f /etc/group ]; then
+  echo
+  echo "Warning: Make sure processed users and groups are from installed programs!"
+fi
+
+# # Create defaults for /etc/passwd, /etc/group
+# cat <<EOT >/etc/passwd
+# root:x:0:0:root:/root:/bin/bash
+# EOT
+# cat <<EOT >/etc/group
+# root:x:0:
+# wheel:x:10:
+# EOT
+
+# Extra lock files created by container processes that might cause issues
+rm -rf \
+  /etc/.pwd.lock \
+  /etc/passwd- \
+  /etc/group- \
+  /etc/shadow- \
+  /etc/gshadow- \
+  /etc/subuid- \
+  /etc/subgid- \
+  /.dockerenv
+
+# # Merge /usr/etc to /etc
+# # OSTree will error out if both dirs exist
+# # And rpm-ostree will be confused and use only one of them
+# if [ -d /usr/etc ]; then
+#   echo
+#   echo WARNING: FOUND /usr/etc. MERGING TO ETC FOR COMPATIBILITY
+#   echo EXPECT PERMISSIONS ISSUES ON THE MERGED PATHS
+#   echo The following files from /usr/etc will be merged to /etc:
+#   tree /usr/etc
+#
+#   echo
+#   rsync -aAX --numeric-ids --checksum --links /usr/etc/ /etc
+#   rm -rf /usr/etc
+# fi
+#
+# # Move /etc to /usr/etc
+# mv /etc /usr/
+
+# ...normal ublue-inspired steps continue.