diff --git a/src/action_executor.zig b/src/action_executor.zig
index 29a208f..73f6950 100644
--- a/src/action_executor.zig
+++ b/src/action_executor.zig
@@ -2111,6 +2111,7 @@ fn createOutputParent(io: std.Io, work_root: std.Io.Dir, path: []const u8) !void
 fn prepareChrootBaseDirs(io: std.Io, chroot_root: std.Io.Dir) !void {
     try chroot_root.createDirPath(io, "dev");
     try chroot_root.createDirPath(io, "proc");
+    try chroot_root.createDirPath(io, "sys");
     try chroot_root.createDirPath(io, "tmp");
     try chroot_root.createDirPath(io, "var/tmp");
 }
@@ -3641,6 +3642,7 @@ test "prepareChrootBaseDirs creates temporary directories" {
     defer work_dir.close(std.testing.io);
 
     try prepareChrootBaseDirs(std.testing.io, work_dir);
+    try work_dir.access(std.testing.io, "sys", .{});
     try work_dir.access(std.testing.io, "tmp", .{});
     try work_dir.access(std.testing.io, "var/tmp", .{});
 }
diff --git a/src/action_runner.zig b/src/action_runner.zig
index 0ecbb14..87c1e08 100644
--- a/src/action_runner.zig
+++ b/src/action_runner.zig
@@ -648,6 +648,13 @@ fn forkAction(action: ForkAction) !std.os.linux.pid_t {
     childSyscallName(linux.chroot(action.chroot_dir.ptr), "chroot");
     childSyscallName(linux.chdir("/"), "chdir_root");
     childSyscallName(linux.mount("proc", "/proc", "proc", linux.MS.NOSUID | linux.MS.NODEV | linux.MS.NOEXEC, 0), "mount_proc");
+    childSyscallName(linux.mount(
+        "sysfs",
+        "/sys",
+        "sysfs",
+        linux.MS.RDONLY | linux.MS.NOSUID | linux.MS.NODEV | linux.MS.NOEXEC,
+        0,
+    ), "mount_sys");
     childDropPrivileges(action.sandbox_uid, action.sandbox_gid);
     childSyscallName(linux.chdir(action.cwd.ptr), "chdir");
     childInstallSocketFilter();