diff --git a/flake.nix b/flake.nix
index 4c54266..85a224b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -30,6 +30,13 @@
           env.CGO_ENABLED = 0;
           ldflags = [ "-s" "-w" ];
 
+          # Non-sandboxed nix builds (e.g. tangled spindles) use /homeless-shelter
+          # as $HOME and abort a derivation if a previous one left it behind. The
+          # Go toolchain writes a config/telemetry file into $HOME, so point HOME
+          # at the per-build $TMPDIR on both the vendor FOD and the main build.
+          preBuild = "export HOME=\"$TMPDIR\"";
+          overrideModAttrs = _: { preBuild = "export HOME=\"$TMPDIR\""; };
+
           meta = {
             description = "Deploy a static site to wisp.place via app-password auth";
             mainProgram = "wisp-deploy";