diff --git a/.gitignore b/.gitignore
index d68c8f0..ab4cabd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@
 /.idea/
 /build/
 app/build/
+app/.cxx/
 captures/
 .DS_Store
 *.apk
diff --git a/rebuild.sh b/rebuild.sh
index dd83854..d0da09c 100755
--- a/rebuild.sh
+++ b/rebuild.sh
@@ -159,6 +159,11 @@ for ARCH_ABI in ${ARCH_ABIS}; do
 done
 
 echo "==> Building debug APK (JAVA_HOME=$JAVA_HOME)"
+# Docker CI on a mounted repo leaves app/.cxx with /opt/android-sdk paths; that breaks local clean/build.
+rm -rf "$ROOT/app/.cxx"
+if [[ -d "$ROOT/app/build" ]] && ! rm -rf "$ROOT/app/build" 2>/dev/null; then
+  echo "WARN: app/build is not writable (often root-owned after Docker). Run: sudo rm -rf app/build" >&2
+fi
 ./gradlew --stop
 ./gradlew clean
 ./gradlew --build-cache assembleDebug
diff --git a/scripts/ci-build-and-publish-ota.sh b/scripts/ci-build-and-publish-ota.sh
index 1a30b6a..bbfb1d7 100755
--- a/scripts/ci-build-and-publish-ota.sh
+++ b/scripts/ci-build-and-publish-ota.sh
@@ -139,3 +139,6 @@ cat >"${OUT_DIR}/BUILD_INFO.json" <<EOF
 EOF
 
 echo "==> Phase: done"
+
+# Mounted-repo Docker runs must not leave /opt/android-sdk paths in app/.cxx on the host.
+rm -rf "$ROOT/app/.cxx"