diff --git a/src/main/kotlin/de/hoennig/werkator/build/BwrapBuildRunner.kt b/src/main/kotlin/de/hoennig/werkator/build/BwrapBuildRunner.kt
index f41cb69..63301f8 100644
--- a/src/main/kotlin/de/hoennig/werkator/build/BwrapBuildRunner.kt
+++ b/src/main/kotlin/de/hoennig/werkator/build/BwrapBuildRunner.kt
@@ -200,6 +200,14 @@ class BwrapBuildRunner(
         args += listOf("--ro-bind", "/etc/resolv.conf", "/etc/resolv.conf")
         args += listOf("--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp")
         args += listOf("--setenv", "HOME", "/root")
+        // The sandbox /tmp is a fresh tmpfs, but bwrap inherits the server's
+        // environment — on hosts with pam_tmpdir that includes
+        // TMPDIR=/tmp/user/<uid>, which does not exist inside and breaks every
+        // tool honoring it (go: "creating work dir: stat ...: no such file or
+        // directory"; the JVM ignores TMPDIR, so Gradle never noticed). Set
+        // both back to /tmp; explicit env below can still override.
+        args += listOf("--setenv", "TMPDIR", "/tmp")
+        args += listOf("--setenv", "TMP", "/tmp")
         for ((key, value) in environment) {
             args += listOf("--setenv", key, value)
         }
diff --git a/src/test/kotlin/de/hoennig/werkator/build/BwrapBuildRunnerTest.kt b/src/test/kotlin/de/hoennig/werkator/build/BwrapBuildRunnerTest.kt
index 65c8932..3e8b988 100644
--- a/src/test/kotlin/de/hoennig/werkator/build/BwrapBuildRunnerTest.kt
+++ b/src/test/kotlin/de/hoennig/werkator/build/BwrapBuildRunnerTest.kt
@@ -104,6 +104,12 @@ class BwrapBuildRunnerTest : FunSpec() {
                     "HOME",
                     "/root",
                     "--setenv",
+                    "TMPDIR",
+                    "/tmp",
+                    "--setenv",
+                    "TMP",
+                    "/tmp",
+                    "--setenv",
                     "branch",
                     "main",
                     "--chdir",