diff --git a/.gnulib b/.gnulib
index 440a1dbe52..b4938324b7 160000
--- a/.gnulib
+++ b/.gnulib
@@ -1 +1 @@
-Subproject commit 440a1dbe523e37f206252cb034c3a62f26867e42
+Subproject commit b4938324b7113c9d73f8390d21f3ecbd842e74b9
diff --git a/autogen.sh b/autogen.sh
index 72f1e7a1a8..d18339768e 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -63,11 +63,22 @@ bootstrap_hash()
 if test -d .git; then
     curr_status=.git-module-status
     t=$(bootstrap_hash; git diff .gnulib)
+    case $t:${CLEAN_SUBMODULE+set} in
+        *:set) ;;
+        *-dirty*)
+            echo "error: gnulib submodule is dirty, please investigate" 2>&1
+            echo "set env-var CLEAN_SUBMODULE to discard gnulib changes" 2>&1
+            exit 1 ;;
+    esac
     if test "$t" = "$(cat $curr_status 2>/dev/null)" \
         && test -f "po/Makevars"; then
         # good, it's up to date, all we need is autoreconf
         autoreconf -if
     else
+        if test ${CLEAN_SUBMODULE+set}; then
+            echo cleaning up submodules...
+            git submodule foreach 'git clean -dfqx && git reset --hard'
+        fi
         echo running bootstrap$no_git...
         ./bootstrap$no_git --bootstrap-sync && bootstrap_hash > $curr_status \
             || { echo "Failed to bootstrap, please investigate."; exit 1; }
diff --git a/cfg.mk b/cfg.mk
index bbfd4a2866..e1fbf4f1a0 100644
--- a/cfg.mk
+++ b/cfg.mk
@@ -700,10 +700,17 @@ ifeq (0,$(MAKELEVEL))
   _clean_requested = $(filter %clean,$(MAKECMDGOALS))
   ifeq (1,$(_update_required)$(_clean_requested))
     $(info INFO: gnulib update required; running ./autogen.sh first)
-Makefile: _autogen
+maint.mk Makefile: _autogen
   endif
 endif
 
+# It is necessary to call autogen any time gnulib changes.  Autogen
+# reruns configure, then we regenerate all Makefiles at once.
+.PHONY: _autogen
+_autogen:
+	$(srcdir)/autogen.sh
+	./config.status
+
 # Give credit where due:
 # Ensure that each commit author email address (possibly mapped via
 # git log's .mailmap) appears in our AUTHORS file.
@@ -718,13 +725,6 @@ sc_check_author_list:
 	  && echo '$(ME): committer(s) not listed in AUTHORS' >&2;	\
 	test $$fail = 0
 
-# It is necessary to call autogen any time gnulib changes.  Autogen
-# reruns configure, then we regenerate all Makefiles at once.
-.PHONY: _autogen
-_autogen:
-	$(srcdir)/autogen.sh
-	./config.status
-
 # regenerate HACKING as part of the syntax-check
 syntax-check: $(top_srcdir)/HACKING