diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in
index 8ee0f5c5..ddb6607e 100644
--- a/scripts/makepkg.sh.in
+++ b/scripts/makepkg.sh.in
@@ -58,6 +58,7 @@ known_hash_algos=('md5' 'sha1' 'sha224' 'sha256' 'sha384' 'sha512' 'whirlpool')
 
 # Options
 ASDEPS=0
+ALLOWSUDOONCE=0 # just a global variable, not an option
 BUILDFUNC=0
 CHECKFUNC=0
 CLEANBUILD=0
@@ -86,6 +87,7 @@ SKIPPGPCHECK=0
 SIGNPKG=''
 SPLITPKG=0
 SOURCEONLY=0
+UNSAFESUDO=0
 VERIFYSOURCE=0
 
 if [[ -n $SOURCE_DATE_EPOCH ]]; then
@@ -113,6 +115,12 @@ done
 trap_exit() {
 	local signal=$1; shift
 
+	if (( ! UNSAFESUDO )); then
+		if type -p sudo >/dev/null; then
+			sudo -k
+		fi
+	fi
+
 	if (( ! INFAKEROOT )); then
 		echo
 		error "$@"
@@ -136,6 +144,12 @@ clean_up() {
 		return 0
 	fi
 
+	if (( EXIT_CODE == E_INSTALL_FAILED && ! UNSAFESUDO )); then
+		if type -p sudo >/dev/null; then
+			sudo -k
+		fi
+	fi
+
 	if (( (EXIT_CODE == E_OK || EXIT_CODE == E_INSTALL_FAILED) && CLEANUP )); then
 		local pkg file
 
@@ -227,7 +241,15 @@ run_pacman() {
 	fi
 	if [[ $1 != -@(T|Q)*([[:alpha:]]) ]]; then
 		if type -p sudo >/dev/null; then
-			cmd=(sudo "${cmd[@]}")
+			if (( UNSAFESUDO )); then
+				# use sudo like sudo (unsafe)
+				cmd=(sudo "${cmd[@]}")
+			else
+				# use sudo like su (safe)
+				# side-effect: this will break most aur-helpers
+				cmd=(sudo -k "${cmd[@]}")
+				ALLOWSUDOONCE=1
+			fi
 		else
 			cmd=(su root -c "$(printf '%q ' "${cmd[@]}")")
 		fi
@@ -271,6 +293,8 @@ handle_deps() {
 			error "$(gettext "'%s' failed to install missing dependencies.")" "$PACMAN"
 			exit $E_INSTALL_DEPS_FAILED
 		fi
+
+		ALLOWSUDOONCE=0
 	fi
 
 	# we might need the new system environment
@@ -336,6 +360,8 @@ remove_deps() {
 		warning "$(gettext "Failed to remove installed dependencies.")"
 		return $E_REMOVE_DEPS_FAILED
 	fi
+
+	ALLOWSUDOONCE=0
 }
 
 error_function() {
@@ -899,6 +925,8 @@ install_package() {
 		warning "$(gettext "Failed to install built package(s).")"
 		return $E_INSTALL_FAILED
 	fi
+
+	ALLOWSUDOONCE=0
 }
 
 get_vcsclient() {
@@ -1197,6 +1225,7 @@ usage() {
 	printf -- "$(gettext "  --skipchecksums  Do not verify checksums of the source files")\n"
 	printf -- "$(gettext "  --skipinteg      Do not perform any verification checks on source files")\n"
 	printf -- "$(gettext "  --skippgpcheck   Do not verify source files with PGP signatures")\n"
+	printf -- "$(gettext "  --unsafesudo     Do not check for cached sudo credentials")\n"
 	printf -- "$(gettext "  --verifysource   Download source files (if needed) and perform integrity checks")\n"
 	echo
 	printf -- "$(gettext "These options can be passed to %s:")\n" "pacman"
@@ -1239,7 +1268,7 @@ OPT_LONG=('allsource' 'check' 'clean' 'cleanbuild' 'config:' 'force' 'geninteg'
           'help' 'holdver' 'ignorearch' 'install' 'key:' 'log' 'noarchive' 'nobuild'
           'nocolor' 'nocheck' 'nodeps' 'noextract' 'noprepare' 'nosign' 'packagelist'
           'printsrcinfo' 'repackage' 'rmdeps' 'sign' 'skipchecksums' 'skipinteg'
-          'skippgpcheck' 'source' 'syncdeps' 'verifysource' 'version')
+          'skippgpcheck' 'source' 'syncdeps' 'verifysource' 'unsafesudo' 'version')
 
 # Pacman Options
 OPT_LONG+=('asdeps' 'noconfirm' 'needed' 'noprogressbar')
@@ -1292,6 +1321,7 @@ while true; do
 		--skippgpcheck)   SKIPPGPCHECK=1;;
 		-s|--syncdeps)    DEP_BIN=1 ;;
 		-S|--source)      SOURCEONLY=1 ;;
+		--unsafesudo)     UNSAFESUDO=1 ;;
 		--verifysource)   VERIFYSOURCE=1 ;;
 
 		-h|--help)        usage; exit $E_OK ;;
@@ -1422,6 +1452,15 @@ else
 	fi
 fi
 
+if (( ! ALLOWSUDOONCE && ! UNSAFESUDO )); then
+	if sudo -n -v >/dev/null 2>/dev/null; then
+		error "$(gettext "Running %s with cached sudo credentials is not allowed as it can\n\
+cause permanent, catastrophic damage to your system. Use '%s' to remove\n\
+cached credentials.")" "makepkg" "sudo -k"
+		exit $E_ROOT
+	fi
+fi
+
 unset pkgname pkgbase pkgver pkgrel epoch pkgdesc url license groups provides
 unset md5sums replaces depends conflicts backup source install changelog build
 unset sha{1,224,256,384,512}sums makedepends optdepends options noextract validpgpkeys