diff --git a/backend/windmill-worker/nsjail/run.csharp.config.proto b/backend/windmill-worker/nsjail/run.csharp.config.proto
index 4a6de952a7..389448eff0 100644
--- a/backend/windmill-worker/nsjail/run.csharp.config.proto
+++ b/backend/windmill-worker/nsjail/run.csharp.config.proto
@@ -104,10 +104,9 @@ mount {
 iface_no_lo: true
 
 mount {
-    src: "{CACHE_DIR}"
-    dst: "/tmp/.cache/csharp"
+    src: "{CACHE_DIR}/{CACHE_HASH}"
+    dst: "/tmp/.cache/csharp/{CACHE_HASH}"
     is_bind: true
-    rw: true
     mandatory: false
 }
 
diff --git a/backend/windmill-worker/nsjail/run.rust.config.proto b/backend/windmill-worker/nsjail/run.rust.config.proto
index 502011049c..3357cd88a9 100644
--- a/backend/windmill-worker/nsjail/run.rust.config.proto
+++ b/backend/windmill-worker/nsjail/run.rust.config.proto
@@ -97,10 +97,9 @@ mount {
 iface_no_lo: true
 
 mount {
-    src: "{CACHE_DIR}"
-    dst: "/tmp/.cache/rust"
+    src: "{CACHE_DIR}/{CACHE_HASH}"
+    dst: "/tmp/.cache/rust/{CACHE_HASH}"
     is_bind: true
-    rw: true
     mandatory: false
 }
 
diff --git a/backend/windmill-worker/src/csharp_executor.rs b/backend/windmill-worker/src/csharp_executor.rs
index 61f53ab65a..5694920e88 100644
--- a/backend/windmill-worker/src/csharp_executor.rs
+++ b/backend/windmill-worker/src/csharp_executor.rs
@@ -543,6 +543,7 @@ pub async fn handle_csharp_job(
             &NSJAIL_CONFIG_RUN_CSHARP_CONTENT
                 .replace("{JOB_DIR}", job_dir)
                 .replace("{CACHE_DIR}", CSHARP_CACHE_DIR)
+                .replace("{CACHE_HASH}", &hash)
                 .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
                 .replace("{SHARED_MOUNT}", shared_mount),
         )?;
diff --git a/backend/windmill-worker/src/rust_executor.rs b/backend/windmill-worker/src/rust_executor.rs
index 639adc709a..95fd822100 100644
--- a/backend/windmill-worker/src/rust_executor.rs
+++ b/backend/windmill-worker/src/rust_executor.rs
@@ -353,6 +353,7 @@ pub async fn handle_rust_job(
             &NSJAIL_CONFIG_RUN_RUST_CONTENT
                 .replace("{JOB_DIR}", job_dir)
                 .replace("{CACHE_DIR}", RUST_CACHE_DIR)
+                .replace("{CACHE_HASH}", &hash)
                 .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
                 .replace("{SHARED_MOUNT}", shared_mount),
         )?;