diff --git a/test/TEST-70-TPM2/test.sh b/test/TEST-70-TPM2/test.sh
index b78670d051..baf75aaf11 100755
--- a/test/TEST-70-TPM2/test.sh
+++ b/test/TEST-70-TPM2/test.sh
@@ -14,7 +14,6 @@ command -v swtpm >/dev/null 2>&1 || exit 0
 command -v tpm2_pcrextend >/dev/null 2>&1 || exit 0
 
 test_append_files() {
-    (
         local workspace="${1:?}"
 
         instmods tpm tpm_tis tpm_ibmvtpm
@@ -26,20 +25,24 @@ test_append_files() {
         if get_bool "$LOOKS_LIKE_DEBIAN"; then
             inst_library "/lib/$(dpkg-architecture -qDEB_HOST_MULTIARCH)/libgcc_s.so.1"
         fi
-    )
 }
 
-machine="$(uname -m)"
-tpmdevice="tpm-tis"
-if [ "$machine" = "ppc64le" ]; then
+TEST_70_TPM_DEVICE="tpm-tis"
+if [[ "$(uname -m)" == "ppc64le" ]]; then
     # tpm-spapr support was introduced in qemu 5.0.0. Skip test for old qemu versions.
     qemu_min_version "5.0.0" || exit 0
-    tpmdevice="tpm-spapr"
+    TEST_70_TPM_DEVICE="tpm-spapr"
 fi
 
-tpmstate=$(mktemp -d)
-swtpm socket --tpm2 --tpmstate dir="$tpmstate" --ctrl type=unixio,path="$tpmstate/sock" &
-trap 'kill %%; rm -rf $tpmstate' SIGINT EXIT
-QEMU_OPTIONS="-chardev socket,id=chrtpm,path=$tpmstate/sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device $tpmdevice,tpmdev=tpm0"
+TEST_70_at_exit() {
+    [[ -n "${TEST_70_SWTPM_PID:-}" ]] && kill "$TEST_70_SWTPM_PID" &>/dev/null
+    [[ -n "${TEST_70_TPM_STATE:-}" ]] && rm -rf "$TEST_70_TPM_STATE"
+}
+
+TEST_70_TPM_STATE="$(mktemp -d)"
+swtpm socket --tpm2 --tpmstate dir="$TEST_70_TPM_STATE" --ctrl type=unixio,path="$TEST_70_TPM_STATE/sock" &
+TEST_70_SWTPM_PID=$!
+add_at_exit_handler TEST_70_at_exit
+QEMU_OPTIONS+=" -chardev socket,id=chrtpm,path=$TEST_70_TPM_STATE/sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device $TEST_70_TPM_DEVICE,tpmdev=tpm0"
 
 do_test "$@"
diff --git a/test/test-functions b/test/test-functions
index acb09c20be..5ca3ccfa84 100644
--- a/test/test-functions
+++ b/test/test-functions
@@ -60,6 +60,33 @@ get_bool() {
     fi
 }
 
+# Since in Bash we can have only one handler per signal, let's overcome this
+# limitation by having one global handler for the EXIT signal which executes
+# all registered handlers
+_AT_EXIT_HANDLERS=()
+_at_exit() {
+    set +e
+
+    # Run the EXIT handlers in reverse order
+    for ((i = ${#_AT_EXIT_HANDLERS[@]} - 1; i >= 0; i--)); do
+        ddebug "Running EXIT handler '${_AT_EXIT_HANDLERS[$i]}'"
+        "${_AT_EXIT_HANDLERS[$i]}"
+    done
+}
+
+trap _at_exit EXIT
+
+add_at_exit_handler() {
+    local handler="${1?}"
+
+    if [[ "$(type -t "$handler")" != "function" ]]; then
+        dfatal "'$handler' is not a function"
+        exit 1
+    fi
+
+    _AT_EXIT_HANDLERS+=("$handler")
+}
+
 # Decide if we can (and want to) run qemu with KVM acceleration.
 # Check if nested KVM is explicitly enabled (TEST_NESTED_KVM). If not,
 # check if it's not explicitly disabled (TEST_NO_KVM) and we're not already
@@ -1238,7 +1265,7 @@ cleanup_loopdev() {
     fi
 }
 
-trap cleanup_loopdev EXIT INT QUIT PIPE
+add_at_exit_handler cleanup_loopdev
 
 create_empty_image() {
     if [ -z "${IMAGE_NAME:=}" ]; then