diff --git a/backend/windmill-worker/nsjail/run.bun.config.proto b/backend/windmill-worker/nsjail/run.bun.config.proto
index 367c1c44de..ce4041c262 100644
--- a/backend/windmill-worker/nsjail/run.bun.config.proto
+++ b/backend/windmill-worker/nsjail/run.bun.config.proto
@@ -12,6 +12,7 @@ cwd: "/tmp/bun"
 
 clone_newnet: false
 clone_newuser: {CLONE_NEWUSER}
+clone_newcgroup: false
 
 keep_caps: false
 keep_env: true
@@ -28,6 +29,11 @@ mount {
 	is_bind: true
 }
 
+mount {
+    src: "/sys/fs"
+    dst: "/sys/fs"
+	is_bind: true
+}
 
 mount {
     src: "/lib64"
diff --git a/backend/windmill-worker/src/deno_executor.rs b/backend/windmill-worker/src/deno_executor.rs
index 9e041ad9b2..5348e2eca0 100644
--- a/backend/windmill-worker/src/deno_executor.rs
+++ b/backend/windmill-worker/src/deno_executor.rs
@@ -269,7 +269,10 @@ run().catch(async (e) => {{
         write_import_map_f
     )?;
 
-    let common_deno_proc_envs = get_common_deno_proc_envs(&token, base_internal_url).await;
+    let mut common_deno_proc_envs = get_common_deno_proc_envs(&token, base_internal_url).await;
+    if !*DISABLE_NSJAIL {
+        common_deno_proc_envs.insert("HOME".to_string(), job_dir.to_string());
+    }
 
     //do not cache local dependencies
     let reload = format!("--reload={base_internal_url}");