diff --git a/build/root/.bazelrc b/build/root/.bazelrc
index 8e989c90f10..e607627357e 100644
--- a/build/root/.bazelrc
+++ b/build/root/.bazelrc
@@ -7,3 +7,7 @@ build --workspace_status_command hack/print-workspace-status.sh
 
 # Make /tmp hermetic
 build --sandbox_tmpfs_path=/tmp
+
+# Ensure that Bazel never runs as root, which can cause unit tests to fail.
+# This flag requires Bazel 0.5.0+
+build --sandbox_fake_username