diff --git a/src/action_executor.zig b/src/action_executor.zig
index 29a208f..06d8ace 100644
--- a/src/action_executor.zig
+++ b/src/action_executor.zig
@@ -2109,7 +2109,7 @@ fn createOutputParent(io: std.Io, work_root: std.Io.Dir, path: []const u8) !void
 }
 
 fn prepareChrootBaseDirs(io: std.Io, chroot_root: std.Io.Dir) !void {
-    try chroot_root.createDirPath(io, "dev");
+    try chroot_root.createDirPath(io, "dev/shm");
     try chroot_root.createDirPath(io, "proc");
     try chroot_root.createDirPath(io, "tmp");
     try chroot_root.createDirPath(io, "var/tmp");
@@ -3641,6 +3641,7 @@ test "prepareChrootBaseDirs creates temporary directories" {
     defer work_dir.close(std.testing.io);
 
     try prepareChrootBaseDirs(std.testing.io, work_dir);
+    try work_dir.access(std.testing.io, "dev/shm", .{});
     try work_dir.access(std.testing.io, "tmp", .{});
     try work_dir.access(std.testing.io, "var/tmp", .{});
 }
diff --git a/src/action_runner.zig b/src/action_runner.zig
index 0ecbb14..36c2ee7 100644
--- a/src/action_runner.zig
+++ b/src/action_runner.zig
@@ -648,6 +648,14 @@ fn forkAction(action: ForkAction) !std.os.linux.pid_t {
     childSyscallName(linux.chroot(action.chroot_dir.ptr), "chroot");
     childSyscallName(linux.chdir("/"), "chdir_root");
     childSyscallName(linux.mount("proc", "/proc", "proc", linux.MS.NOSUID | linux.MS.NODEV | linux.MS.NOEXEC, 0), "mount_proc");
+    const shared_memory_mount_data: [:0]const u8 = "mode=1777,size=64m";
+    childSyscallName(linux.mount(
+        "tmpfs",
+        "/dev/shm",
+        "tmpfs",
+        linux.MS.NOSUID | linux.MS.NODEV | linux.MS.NOEXEC,
+        @intFromPtr(shared_memory_mount_data.ptr),
+    ), "mount_shm");
     childDropPrivileges(action.sandbox_uid, action.sandbox_gid);
     childSyscallName(linux.chdir(action.cwd.ptr), "chdir");
     childInstallSocketFilter();