diff --git a/.github/workflows/docker-image-size-analysis.yml b/.github/workflows/docker-image-size-analysis.yml
index 80e05196cf..cab455ad0f 100644
--- a/.github/workflows/docker-image-size-analysis.yml
+++ b/.github/workflows/docker-image-size-analysis.yml
@@ -81,6 +81,17 @@ jobs:
           size_bytes="$(docker image inspect eve-docker-size:current --format '{{.Size}}')"
           echo "size_bytes=$size_bytes" >> "$GITHUB_OUTPUT"
 
+      - name: Verify sandbox user workspace and sudo permissions
+        run: |
+          docker run --rm eve-docker-size:current bash -lc '
+            set -euo pipefail
+            test "$(id -un)" = vercel-sandbox
+            test "$(stat -c %U /workspace)" = vercel-sandbox
+            git init --quiet /workspace
+            git -C /workspace remote add origin https://github.com/vercel/eve.git
+            sudo -n true
+          '
+
       - name: Generate Docker image size report
         env:
           BASELINE_LABEL: ${{ steps.baseline.outputs.label }}
diff --git a/Dockerfile b/Dockerfile
index e6ed08af66..dcaf4c78b5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -84,4 +84,5 @@ RUN set -eux; \
   printf 'vercel-sandbox ALL=(ALL) NOPASSWD:ALL\n' >/etc/sudoers.d/vercel-sandbox; \
   chmod 0440 /etc/sudoers.d/vercel-sandbox
 
+USER vercel-sandbox
 WORKDIR /workspace
diff --git a/docs/sandbox.mdx b/docs/sandbox.mdx
index 9c28f05fbf..0a1a96bf6c 100644
--- a/docs/sandbox.mdx
+++ b/docs/sandbox.mdx
@@ -100,7 +100,7 @@ export default defineSandbox({
   revalidationKey: () => "repo-bootstrap-v1",
   async bootstrap({ use }) {
     const sandbox = await use();
-    await sandbox.run({ command: "apt-get install -y jq" });
+    await sandbox.run({ command: "sudo apt-get install -y jq" });
   },
   async onSession({ use }) {
     await use({ networkPolicy: "deny-all" });