diff --git a/.github/buildomat/jobs/build-and-test.sh b/.github/buildomat/jobs/build-and-test.sh
index 4f114c7ba03..99983f7a979 100644
--- a/.github/buildomat/jobs/build-and-test.sh
+++ b/.github/buildomat/jobs/build-and-test.sh
@@ -20,6 +20,14 @@ ptime -m ./tools/ci_download_clickhouse
 banner cockroach
 ptime -m bash ./tools/ci_download_cockroachdb
 
+#
+# Set up a custom temporary directory within whatever one we were given so that
+# we can check later whether we left detritus around.
+#
+TEST_TMPDIR="${TMPDIR:-/var/tmp}/omicron_tmp"
+echo "tests will store output in $TEST_TMPDIR"
+mkdir $TEST_TMPDIR
+
 #
 # Put "./cockroachdb/bin" and "./clickhouse" on the PATH for the test
 # suite.
@@ -43,6 +51,7 @@ export PATH="$PATH:$PWD/out/cockroachdb/bin:$PWD/out/clickhouse"
 banner build
 export RUSTFLAGS="-D warnings"
 export RUSTDOCFLAGS="-D warnings"
+export TMPDIR=$TEST_TMPDIR
 ptime -m cargo +'nightly-2022-04-27' build --locked --all-targets --verbose
 
 #
@@ -57,3 +66,12 @@ ptime -m cargo run --bin omicron-package -- check
 #
 banner test
 ptime -m cargo +'nightly-2022-04-27' test --workspace --locked --verbose
+
+#
+# Make sure that we have left nothing around in $TEST_TMPDIR.  The easiest way
+# to check is to try to remove it with `rmdir`.
+#
+unset TMPDIR
+echo "files in $TEST_TMPDIR (none expected on success):"
+find $TEST_TMPDIR -ls
+rmdir $TEST_TMPDIR
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index ab301e3e129..17fafc128ac 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -145,8 +145,7 @@ jobs:
       # Put "./cockroachdb/bin" and "./clickhouse" on the PATH for the test
       # suite.
       run: TMPDIR=$OMICRON_TMP PATH="$PATH:$PWD/out/cockroachdb/bin:$PWD/out/clickhouse" RUSTFLAGS="-D warnings" RUSTDOCFLAGS="-D warnings" cargo test --no-fail-fast --workspace --locked --verbose
-    - name: Archive any failed test results
-      if: ${{ failure() }}
+    - name: Archive results left by tests
       # actions/upload-artifact@v2.3.1
       uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2
       with:
@@ -156,3 +155,9 @@ jobs:
           ${{ env.OMICRON_TMP }}
           !${{ env.OMICRON_TMP }}/crdb-base
           !${{ env.OMICRON_TMP }}/rustc*
+    # Fail the build if successful tests leave detritus in $TMPDIR.  The easiest
+    # way to check if the directory is empty is to try to remove it with
+    # `rmdir`.
+    - name: Remove temporary directory on success (if this fails, tests leaked files in TMPDIR)
+      if: ${{ success() }}
+      run: rmdir $OMICRON_TMP
diff --git a/nexus/src/db/explain.rs b/nexus/src/db/explain.rs
index dc958f225f1..7a449cd390d 100644
--- a/nexus/src/db/explain.rs
+++ b/nexus/src/db/explain.rs
@@ -166,7 +166,7 @@ mod test {
     #[tokio::test]
     async fn test_explain() {
         let logctx = dev::test_setup_log("test_explain");
-        let db = test_setup_database(&logctx.log).await;
+        let mut db = test_setup_database(&logctx.log).await;
         let cfg = db::Config { url: db.pg_config().clone() };
         let pool = db::Pool::new(&cfg);
 
@@ -190,6 +190,7 @@ mod test {
             )
             .await
             .unwrap();
+        db.cleanup().await.unwrap();
         logctx.cleanup_successful();
     }
 
@@ -197,7 +198,7 @@ mod test {
     #[tokio::test]
     async fn test_explain_async() {
         let logctx = dev::test_setup_log("test_explain_async");
-        let db = test_setup_database(&logctx.log).await;
+        let mut db = test_setup_database(&logctx.log).await;
         let cfg = db::Config { url: db.pg_config().clone() };
         let pool = db::Pool::new(&cfg);
 
@@ -212,6 +213,7 @@ mod test {
             .unwrap();
 
         assert_contents("tests/output/test-explain-output", &explanation);
+        db.cleanup().await.unwrap();
         logctx.cleanup_successful();
     }
 
@@ -219,7 +221,7 @@ mod test {
     #[tokio::test]
     async fn test_explain_full_table_scan() {
         let logctx = dev::test_setup_log("test_explain_full_table_scan");
-        let db = test_setup_database(&logctx.log).await;
+        let mut db = test_setup_database(&logctx.log).await;
         let cfg = db::Config { url: db.pg_config().clone() };
         let pool = db::Pool::new(&cfg);
 
@@ -238,6 +240,7 @@ mod test {
             "Expected [{}] to contain 'FULL SCAN'",
             explanation
         );
+        db.cleanup().await.unwrap();
         logctx.cleanup_successful();
     }
 }