diff --git a/meta-ohos-staging/recipes-security/optee/optee-os-stm32mp_3.12.0.bbappend b/meta-ohos-staging/recipes-security/optee/optee-os-stm32mp_3.12.0.bbappend
new file mode 100644
index 0000000000000000000000000000000000000000..3353bcab37b8218ad7a7314ae1cd8362265a6f70
--- /dev/null
+++ b/meta-ohos-staging/recipes-security/optee/optee-os-stm32mp_3.12.0.bbappend
@@ -0,0 +1,7 @@
+# This is only safe because this recipes uses out-of-tree builds. The package's
+# make design caches sysroot paths as make dependencies (see the .d files).
+# Some of these paths are versioned (gcc for example) so recompiling after a
+# gcc bump would make those dependencies fail. Forcing a clean build directory
+# when configure task is invalidated (which happens when native sysroot is
+# regenerated), fixes the dependency issue.
+do_configure[cleandirs] = "${B}"