diff --git a/.bazelrc b/.bazelrc
index b690d15f..fd194083 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -2,7 +2,7 @@
 common --enable_bzlmod
 
 # Spawn strategy required for some tests
-build --spawn_strategy=standalone
+build --spawn_strategy=local
 
 # Setup Xcode configuration.
 build --xcode_version_config=//:host_xcodes
@@ -62,6 +62,14 @@ build:remote_cache --noslim_profile
 build:remote_cache --remote_cache=grpcs://remote.buildbuddy.io
 build:remote_cache --remote_timeout=3600
 
+build:sandboxed --strategy=SwiftCompile=sandboxed
+build:sandboxed --spawn_strategy=sandboxed
+build:sandboxed --strategy=Genrule=sandboxed,local
+build:sandboxed --strategy=StoryboardCompile=sandboxed,local
+build:sandboxed --strategy=CleaningFramework=sandboxed,local
+build:sandboxed --strategy=StoryboardLink=sandboxed,local
+build:sandboxed --strategy=ProcessAndSign=sandboxed,local
+
 # By default don't upload local results to remote cache, only CI does this.
 build --noremote_upload_local_results
 build:ci --remote_upload_local_results
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index dbacbcf4..96fc9f1f 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,7 +15,7 @@ concurrency:
 #       when adding a new job / changing the matrix, make sure to update all jobs
 jobs:
   integration_tests:
-    name: Build and test (Bazel ${{ matrix.bazel_version }} / Xcode ${{ matrix.xcode_version }} / Virtual Frameworks ${{ matrix.virtual_frameworks }})
+    name: Build and test (Bazel ${{ matrix.bazel_version }} / Xcode ${{ matrix.xcode_version }} / Virtual Frameworks ${{ matrix.virtual_frameworks }}) / Sandbox ${{ matrix.sandbox }}
     runs-on: macos-14
     strategy:
       fail-fast: false
@@ -23,6 +23,7 @@ jobs:
         bazel_version: [6.5.0, 7.1.0]
         xcode_version: [15.2]
         virtual_frameworks: [true, false]
+        sandbox: [true, false]
     env:
         XCODE_VERSION: ${{ matrix.xcode_version }}
         USE_BAZEL_VERSION: ${{ matrix.bazel_version }}
@@ -34,6 +35,10 @@ jobs:
         name: Add vfs config
         run: |
           echo "build --config=vfs" >> user.bazelrc
+      - if: matrix.sandbox
+        name: Enable sandbox mode
+        run: |
+          echo "build --config=sandboxed" >> user.bazelrcc
       - name: Build and Test
         run: |
           # non-iOS tests
diff --git a/rules/library.bzl b/rules/library.bzl
index 76afd653..d9a0d8cf 100644
--- a/rules/library.bzl
+++ b/rules/library.bzl
@@ -953,8 +953,6 @@ def apple_library(
         generated_swift_header_name = module_name + "-Swift.h"
 
         if module_map:
-            # TODO: now that we always add module_map as a swiftc_input,
-            # we should consider removing this one if it's not needed
             extend_modulemap(
                 name = module_map + ".extended." + name,
                 destination = "%s.extended.modulemap" % name,
diff --git a/tests/ios/unit-test/test-imports-app/TestImports-Unit-Tests-Bridging-Header.h b/tests/ios/unit-test/test-imports-app/TestImports-Unit-Tests-Bridging-Header.h
index 37c6e52a..bf54b734 100644
--- a/tests/ios/unit-test/test-imports-app/TestImports-Unit-Tests-Bridging-Header.h
+++ b/tests/ios/unit-test/test-imports-app/TestImports-Unit-Tests-Bridging-Header.h
@@ -1,2 +1 @@
 #import <TestImports-Unit-Tests/testhelper.h>
-#import <TestImports-App/Header2.h>
diff --git a/tests/ios/unit-test/test-imports-app/test.swift b/tests/ios/unit-test/test-imports-app/test.swift
index 79f0eec4..bbacce88 100644
--- a/tests/ios/unit-test/test-imports-app/test.swift
+++ b/tests/ios/unit-test/test-imports-app/test.swift
@@ -5,6 +5,6 @@ class SwiftTests : XCTestCase {
   func testPasses() {
       _ = EmptyStruct()
       XCTAssertTrue(true)
-      XCTAssertEqual(TestHelper.createString(), "ObjcTestHelperString_EnumValue=1")
+      XCTAssertEqual(TestHelper.createString(), "ObjcTestHelperString_EnumValue=\(AppErrorCode.unknown.rawValue)")
   }
 }