diff --git a/core/scripts/BUILD b/core/scripts/BUILD
index ce5e9a5..b03bc49 100644
--- a/core/scripts/BUILD
+++ b/core/scripts/BUILD
@@ -6,13 +6,13 @@
         "@//core:swtpm_data",
         "@edk2//:firmware",
     ],
-    tags = ["local"],
 )
 
 sh_test(
     name = "test_boot",
     size = "small",
     srcs = ["test_boot.sh"],
+    # expects wants a pty, which do not exist in the sandbox
     tags = ["local"],
     deps = [":launch"],
 )
diff --git a/core/scripts/launch.sh b/core/scripts/launch.sh
index 4aa2d9c..c375528 100755
--- a/core/scripts/launch.sh
+++ b/core/scripts/launch.sh
@@ -1,6 +1,12 @@
 #!/bin/sh
 
-swtpm socket --tpmstate dir=core/tpm --ctrl type=unixio,path=tpm-socket --tpm2 &
+TMP=$(mktemp -d)
+trap "{ rm -rf "$TMP"; pkill -9 -P $$; }" EXIT
+
+# sandbox uses a symlink farm - without -L, we would just copy the symlinks
+cp -Lr core/tpm/* "${TMP}"
+
+swtpm socket --tpmstate dir=${TMP} --ctrl type=unixio,path=tpm-socket --tpm2 &
 
 qemu-system-x86_64 \
     -cpu host -smp sockets=1,cpus=1,cores=2,threads=2,maxcpus=4 -m 1024 -machine q35 -enable-kvm -nographic -nodefaults \
@@ -16,4 +22,5 @@
     -global isa-debugcon.iobase=0x402 \
     -device ipmi-bmc-sim,id=ipmi0 \
     -device virtio-rng-pci \
-    -serial mon:stdio
+    -serial stdio \
+    | stdbuf -oL tr -d '\r' | cat -v