diff --git a/.gitignore b/.gitignore
index 8cab96cbc75..6991faf08ee 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,12 +2,7 @@ vendor/pkg
 /runc
 /runc-*
 /contrib/cmd/memfd-bind/memfd-bind
-/tests/cmd/recvtty/recvtty
-/tests/cmd/sd-helper/sd-helper
-/tests/cmd/seccompagent/seccompagent
-/tests/cmd/fs-idmap/fs-idmap
-/tests/cmd/pidfd-kill/pidfd-kill
-/tests/cmd/remap-rootfs/remap-rootfs
+/tests/cmd/_bin
 man/man8
 release
 Vagrantfile
diff --git a/Makefile b/Makefile
index 1ddaefaa29a..39c1ef918d4 100644
--- a/Makefile
+++ b/Makefile
@@ -77,26 +77,27 @@ runc-bin:
 	$(GO_BUILD) -o runc .
 
 .PHONY: all
-all: runc memfd-bind recvtty sd-helper seccompagent fs-idmap pidfd-kill remap-rootfs
+all: runc memfd-bind
 
 .PHONY: memfd-bind
 memfd-bind:
 	$(GO_BUILD) -o contrib/cmd/$@/$@ ./contrib/cmd/$@
 
-.PHONY: recvtty sd-helper seccompagent fs-idmap pidfd-kill remap-rootfs
-recvtty sd-helper seccompagent fs-idmap pidfd-kill remap-rootfs:
-	$(GO_BUILD) -o tests/cmd/$@/$@ ./tests/cmd/$@
+TESTBINDIR := tests/cmd/_bin
+$(TESTBINDIR):
+	mkdir $(TESTBINDIR)
+
+TESTBINS := recvtty sd-helper seccompagent fs-idmap pidfd-kill remap-rootfs
+.PHONY: test-binaries $(TESTBINS)
+test-binaries: $(TESTBINS)
+$(TESTBINS): $(TESTBINDIR)
+	$(GO_BUILD) -o $(TESTBINDIR) ./tests/cmd/$@
 
 .PHONY: clean
 clean:
 	rm -f runc runc-*
 	rm -f contrib/cmd/memfd-bind/memfd-bind
-	rm -f tests/cmd/recvtty/recvtty
-	rm -f tests/cmd/sd-helper/sd-helper
-	rm -f tests/cmd/seccompagent/seccompagent
-	rm -f tests/cmd/fs-idmap/fs-idmap
-	rm -f tests/cmd/pidfd-kill/pidfd-kill
-	rm -f tests/cmd/remap-rootfs/remap-rootfs
+	rm -fr $(TESTBINDIR)
 	sudo rm -rf release
 	rm -rf man/man8
 
@@ -128,7 +129,7 @@ dbuild: runcimage
 	$(CONTAINER_ENGINE) run $(CONTAINER_ENGINE_RUN_FLAGS) \
 		--privileged --rm \
 		-v $(CURDIR):/go/src/$(PROJECT) \
-		$(RUNC_IMAGE) make clean all
+		$(RUNC_IMAGE) make clean runc test-binaries
 
 .PHONY: lint
 lint:
@@ -157,7 +158,7 @@ unittest: runcimage
 		$(RUNC_IMAGE) make localunittest TESTFLAGS="$(TESTFLAGS)"
 
 .PHONY: localunittest
-localunittest: all
+localunittest: test-binaries
 	$(GO) test -timeout 3m -tags "$(BUILDTAGS)" $(TESTFLAGS) -v ./...
 
 .PHONY: integration
@@ -169,7 +170,7 @@ integration: runcimage
 		$(RUNC_IMAGE) make localintegration TESTPATH="$(TESTPATH)"
 
 .PHONY: localintegration
-localintegration: all
+localintegration: runc test-binaries
 	bats -t tests/integration$(TESTPATH)
 
 .PHONY: rootlessintegration
@@ -181,7 +182,7 @@ rootlessintegration: runcimage
 		$(RUNC_IMAGE) make localrootlessintegration
 
 .PHONY: localrootlessintegration
-localrootlessintegration: all
+localrootlessintegration: runc test-binaries
 	tests/rootless.sh
 
 .PHONY: shell
diff --git a/tests/cmd/README.md b/tests/cmd/README.md
new file mode 100644
index 00000000000..27f636ca3e5
--- /dev/null
+++ b/tests/cmd/README.md
@@ -0,0 +1,4 @@
+These are helpers used by [integration tests](/tests/integration).
+
+They are compiled from the top-level Makefile via `make test-binaries`,
+and the resulting binaries can be found in `./_bin`.
diff --git a/tests/cmd/seccompagent/README.md b/tests/cmd/seccompagent/README.md
index 80638797adb..193e856b156 100644
--- a/tests/cmd/seccompagent/README.md
+++ b/tests/cmd/seccompagent/README.md
@@ -12,12 +12,12 @@ behaviour can break the integration tests.
 
 Compile runc and seccompagent:
 ```bash
-make all
+make runc seccompagent
 ```
 
 Run the seccomp agent in the background:
 ```bash
-sudo ./tests/cmd/seccompagent/seccompagent &
+sudo ./tests/cmd/_bin/seccompagent &
 ```
 
 Prepare a container:
diff --git a/tests/integration/helpers.bash b/tests/integration/helpers.bash
index 85f1fb0a558..f370e9b5a82 100755
--- a/tests/integration/helpers.bash
+++ b/tests/integration/helpers.bash
@@ -13,12 +13,9 @@ eval "$IMAGES"
 unset IMAGES
 
 : "${RUNC:="${INTEGRATION_ROOT}/../../runc"}"
-RECVTTY="${INTEGRATION_ROOT}/../../tests/cmd/recvtty/recvtty"
-SD_HELPER="${INTEGRATION_ROOT}/../../tests/cmd/sd-helper/sd-helper"
-SECCOMP_AGENT="${INTEGRATION_ROOT}/../../tests/cmd/seccompagent/seccompagent"
-FS_IDMAP="${INTEGRATION_ROOT}/../../tests/cmd/fs-idmap/fs-idmap"
-PIDFD_KILL="${INTEGRATION_ROOT}/../../tests/cmd/pidfd-kill/pidfd-kill"
-REMAP_ROOTFS="${INTEGRATION_ROOT}/../../tests/cmd/remap-rootfs/remap-rootfs"
+
+# Path to binaries compiled from packages in tests/cmd by "make test-binaries").
+TESTBINDIR=${INTEGRATION_ROOT}/../cmd/_bin
 
 # Some variables may not always be set. Set those to empty value,
 # if unset, to avoid "unbound variable" error.
@@ -143,7 +140,7 @@ function init_cgroup_paths() {
 function create_parent() {
 	if [ -v RUNC_USE_SYSTEMD ]; then
 		[ ! -v SD_PARENT_NAME ] && return
-		"$SD_HELPER" --parent machine.slice start "$SD_PARENT_NAME"
+		"$TESTBINDIR/sd-helper" --parent machine.slice start "$SD_PARENT_NAME"
 	else
 		[ ! -v REL_PARENT_PATH ] && return
 		if [ -v CGROUP_V2 ]; then
@@ -163,7 +160,7 @@ function create_parent() {
 function remove_parent() {
 	if [ -v RUNC_USE_SYSTEMD ]; then
 		[ ! -v SD_PARENT_NAME ] && return
-		"$SD_HELPER" --parent machine.slice stop "$SD_PARENT_NAME"
+		"$TESTBINDIR/sd-helper" --parent machine.slice stop "$SD_PARENT_NAME"
 	else
 		[ ! -v REL_PARENT_PATH ] && return
 		if [ -v CGROUP_V2 ]; then
@@ -715,7 +712,7 @@ function setup_recvtty() {
 	export CONSOLE_SOCKET="$dir/sock"
 
 	# We need to start recvtty in the background, so we double fork in the shell.
-	("$RECVTTY" --pid-file "$dir/pid" --mode null "$CONSOLE_SOCKET" &) &
+	("$TESTBINDIR/recvtty" --pid-file "$dir/pid" --mode null "$CONSOLE_SOCKET" &) &
 }
 
 function teardown_recvtty() {
@@ -732,7 +729,7 @@ function teardown_recvtty() {
 }
 
 function setup_seccompagent() {
-	("${SECCOMP_AGENT}" -socketfile="$SECCCOMP_AGENT_SOCKET" -pid-file "$BATS_TMPDIR/seccompagent.pid" &) &
+	("$TESTBINDIR/seccompagent" -socketfile="$SECCCOMP_AGENT_SOCKET" -pid-file "$BATS_TMPDIR/seccompagent.pid" &) &
 }
 
 function teardown_seccompagent() {
@@ -790,7 +787,7 @@ function teardown_bundle() {
 function remap_rootfs() {
 	[ ! -v ROOT ] && return 0 # nothing to remap
 
-	"$REMAP_ROOTFS" "$ROOT/bundle"
+	"$TESTBINDIR/remap-rootfs" "$ROOT/bundle"
 }
 
 function is_kernel_gte() {
@@ -812,7 +809,7 @@ function requires_idmap_fs() {
 
 	# We need to "|| true" it to avoid CI failure as this binary may return with
 	# something different than 0.
-	stderr=$($FS_IDMAP "$fs" 2>&1 >/dev/null || true)
+	stderr=$("$TESTBINDIR/fs-idmap" "$fs" 2>&1 >/dev/null || true)
 
 	case $stderr in
 	*invalid\ argument)
@@ -846,7 +843,7 @@ function setup_pidfd_kill() {
 	mkdir "${dir}"
 	export PIDFD_SOCKET="${dir}/sock"
 
-	("${PIDFD_KILL}" --pid-file "${dir}/pid" --signal "${signal}" "${PIDFD_SOCKET}" &) &
+	("$TESTBINDIR/pidfd-kill" --pid-file "${dir}/pid" --signal "${signal}" "${PIDFD_SOCKET}" &) &
 
 	# ensure socket is ready
 	retry 10 1 stat "${PIDFD_SOCKET}"
diff --git a/tests/integration/update.bats b/tests/integration/update.bats
index 4d928c42f47..22a92e8bd69 100644
--- a/tests/integration/update.bats
+++ b/tests/integration/update.bats
@@ -801,7 +801,7 @@ EOF
 	TMP_RECVTTY_PID="$TMP_RECVTTY_DIR/recvtty.pid"
 	TMP_CONSOLE_SOCKET="$TMP_RECVTTY_DIR/console.sock"
 	CONTAINER_OUTPUT="$TMP_RECVTTY_DIR/output"
-	("$RECVTTY" --no-stdin --pid-file "$TMP_RECVTTY_PID" \
+	("$TESTBINDIR/recvtty" --no-stdin --pid-file "$TMP_RECVTTY_PID" \
 		--mode single "$TMP_CONSOLE_SOCKET" &>"$CONTAINER_OUTPUT") &
 	retry 10 0.1 [ -e "$TMP_CONSOLE_SOCKET" ]