diff --git a/internal/assembly/boot/boot_test.go b/internal/assembly/boot/boot_test.go
index 0b399e0580..1577395b4a 100644
--- a/internal/assembly/boot/boot_test.go
+++ b/internal/assembly/boot/boot_test.go
@@ -4161,7 +4161,7 @@ func TestRuntimeForbidReadRootsAddsOnlyGlobalCredentialFile(t *testing.T) {
 	cfg := config.Default()
 	cfg.Sandbox.ForbidRead = []string{configured}
 	withoutCredentials := RuntimeForbidReadRoots(cfg, ".")
-	hostSecrets := append(secrets.HostSecretPaths(), cfg.Roots().RemoteStateDir(), cfg.Roots().ScheduleDir(), cfg.Roots().PeersDir())
+	hostSecrets := append(secrets.HostSecretPaths(), cfg.Roots().RemoteStateDir(), cfg.Roots().ScheduleDir(), cfg.Roots().PeersDir(), cfg.Roots().SandboxDir())
 	if !reflect.DeepEqual(withoutCredentials, appendUniquePaths([]string{configured}, hostSecrets...)) {
 		t.Fatalf("roots without global credentials = %v", withoutCredentials)
 	}