diff --git a/src/servers/sidecar/sandbox.ts b/src/servers/sidecar/sandbox.ts
index 50cd2384..a394de67 100644
--- a/src/servers/sidecar/sandbox.ts
+++ b/src/servers/sidecar/sandbox.ts
@@ -10,6 +10,7 @@ const BUN_DIR = (() => {
 
 const PROJECT_ROOT = resolve(import.meta.dir, '../../..');
 const DATA_PATH = process.env.DATA_PATH ?? join(process.cwd(), 'data');
+const HOST_HOME = process.env.HOME!;
 
 // Resolve the OS username for runuser to drop privileges inside the sandbox
 const OS_USERNAME = (() => {
@@ -72,7 +73,7 @@ export function buildSandboxPrefix(email: string): string[] {
 
   // Ensure intermediate dirs under HOME are traversable after runuser drops privileges
   // (bwrap auto-creates them as root-owned drwx------)
-  const homeDir = process.env.HOME!;
+  const homeDir = HOST_HOME;
   args.push('--perms', '0755', '--dir', homeDir);
 
   // Bun runtime (e.g. /home/pastilhas/.bun)