diff --git a/.bazelrc b/.bazelrc
index 7144d1d9..575c0efa 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -9,7 +9,8 @@ build --worker_sandboxing
 
 # TODO: turn this back on when Zig can build CGo (https://github.com/uber/hermetic_cc_toolchain/issues/10)
 #build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
-build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline
 build --sandbox_add_mount_pair=/tmp
+build --sandbox_add_mount_pair=/var/tmp
 
+build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline
 build:darwin_toolchains --extra_toolchains @zig_sdk//toolchain:darwin_amd64,@zig_sdk//toolchain:darwin_arm64
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1026601b..9b6d6ae4 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -29,7 +29,7 @@ jobs:
         with:
           key: cache-${{ matrix.os }}-${{ hashFiles('.bazelversion', 'toolchain/private/zig_sdk.bzl', '.github/workflows/ci.yaml') }}
           path: |
-            C:\Temp\hermetic_cc_toolchain
+            C:\Temp\zig-cache
             ~\AppData\Local\bazelisk'
 
       - uses: actions/cache@v4
@@ -38,7 +38,7 @@ jobs:
         with:
           key: cache-${{ matrix.os }}-${{ hashFiles('.bazelversion', 'toolchain/private/zig_sdk.bzl', '.github/workflows/ci.yaml') }}
           path: |
-            /tmp/zig-cache
+            /var/tmp/zig-cache
             ~/Library/Caches/bazelisk
 
       - uses: actions/cache@v4
diff --git a/README.md b/README.md
index 80d483d4..9357b4b8 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,7 @@ And this to `.bazelrc` on a Unix-y systems:
 
 ```
 build --sandbox_add_mount_pair=/tmp
+build --sandbox_add_mount_pair=/var/tmp
 ```
 
 Windows:
@@ -70,10 +71,11 @@ Windows:
 build --sandbox_add_mount_pair=C:\Temp
 ```
 
-The directories can be narrowed down to `/tmp/zig-cache` and
-`C:\Temp\hermetic_cc_toolchain` respectively if it can be ensured they will be
-created before the invocation of `bazel build`. See [#83][pr-83] for more
-context. If a different place is prefferred for zig cache, set:
+The directories can be narrowed down to `/tmp/zig-cache` (Linux),
+`/var/tmp/zig-cache` (MacOS) and `C:\Temp\zig-cache` respectively
+if it can be ensured they will be created before the invocation of `bazel
+build`. See [#83][pr-83] for more context. If a different place is prefferred
+for zig cache, set:
 
 ```
 build --repo_env=HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX=/path/to/cache
@@ -329,7 +331,7 @@ will be accepted.
 
 ### Zig cache location
 
-Currently zig cache is stored in `/tmp/hermetic_cc_toolchain`, so `bazel clean
+Currently zig cache is stored in `/var/tmp/zig-cache`, so `bazel clean
 --expunge` will not clear the zig cache. Zig's cache should be stored somewhere
 in the project's path. It is not clear how to do it.
 
diff --git a/ci/test b/ci/test
index a22916bf..7bef54ac 100755
--- a/ci/test
+++ b/ci/test
@@ -5,7 +5,13 @@
 
 set -xeuo pipefail
 
-cache_prefix="${HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX:-/tmp/zig-cache}"
+case "$(uname)" in
+    Linux) default_cache_prefix='/tmp/zig-cache' ;;
+    Darwin) default_cache_prefix='/var/tmp/zig-cache' ;;
+    *) default_cache_prefix='C:\Temp\zig-cache' ;;
+esac
+
+cache_prefix="${HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX:-$default_cache_prefix}"
 
 # check a very hermetic setup with a single target. Re-building all of
 # them takes a long time, so using only one. If we ever decide to build all
diff --git a/examples/bzlmod/.bazelrc b/examples/bzlmod/.bazelrc
index 143b0e95..5eb42544 100644
--- a/examples/bzlmod/.bazelrc
+++ b/examples/bzlmod/.bazelrc
@@ -3,9 +3,13 @@
 test --sandbox_default_allow_network=false
 test --test_output=errors
 
+build --incompatible_disallow_empty_glob
 build --verbose_failures
 build --worker_sandboxing
 
 build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+
 build --sandbox_add_mount_pair=/tmp
+build --sandbox_add_mount_pair=/var/tmp
+
 build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline
diff --git a/examples/rules_cc/.bazelrc b/examples/rules_cc/.bazelrc
index 143b0e95..aa3f2f7b 100644
--- a/examples/rules_cc/.bazelrc
+++ b/examples/rules_cc/.bazelrc
@@ -3,9 +3,12 @@
 test --sandbox_default_allow_network=false
 test --test_output=errors
 
+build --incompatible_disallow_empty_glob
 build --verbose_failures
 build --worker_sandboxing
 
 build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+
 build --sandbox_add_mount_pair=/tmp
+build --sandbox_add_mount_pair=/var/tmp
 build --experimental_output_directory_naming_scheme=diff_against_dynamic_baseline
diff --git a/toolchain/defs.bzl b/toolchain/defs.bzl
index 54ae5759..f6f613e7 100644
--- a/toolchain/defs.bzl
+++ b/toolchain/defs.bzl
@@ -148,9 +148,13 @@ def _zig_repository_impl(repository_ctx):
     cache_prefix = repository_ctx.os.environ.get("HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX", "")
     if cache_prefix == "":
         if os == "windows":
-            cache_prefix = "C:\\\\Temp\\\\hermetic_cc_toolchain"
-        else:
+            cache_prefix = "C:\\\\Temp\\\\zig-cache"
+        elif os == "macos":
+            cache_prefix = "/var/tmp/zig-cache"
+        elif os == "linux":
             cache_prefix = "/tmp/zig-cache"
+        else:
+            fail("unknown os: {}".format(os))
 
     repository_ctx.template(
         "tools/zig-wrapper.zig",