diff --git a/build/root/.bazelrc b/build/root/.bazelrc
index ab5db1d2dc3..8e989c90f10 100644
--- a/build/root/.bazelrc
+++ b/build/root/.bazelrc
@@ -4,3 +4,6 @@ test --test_output=errors
 
 # Include git version info
 build --workspace_status_command hack/print-workspace-status.sh
+
+# Make /tmp hermetic
+build --sandbox_tmpfs_path=/tmp