diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index 2da33e6..96c075c 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -38,7 +38,7 @@
 
         # runsc/gVisor
         "@com_github_google_gvisor//runsc": "/containerd/bin/runsc",
-        "@com_github_google_gvisor_containerd_shim//cmd/containerd-shim-runsc-v1": "/containerd/bin/containerd-shim-runsc-v1",
+        "@com_github_google_gvisor//shim/v2:containerd-shim-runsc-v1": "/containerd/bin/containerd-shim-runsc-v1",
 
         # runc (runtime in files_cc because of cgo)
         "@com_github_containerd_containerd//cmd/containerd-shim-runc-v2": "/containerd/bin/containerd-shim-runc-v2",
@@ -88,8 +88,8 @@
         "//metropolis/node/build/mkimage",
     ],
     visibility = [
-        "//metropolis/test/launch:__subpackages__",
         "//metropolis/test/e2e:__subpackages__",
+        "//metropolis/test/launch:__subpackages__",
     ],
 )
 
@@ -131,8 +131,8 @@
     cp tpm/ca/signkey.pem $(location tpm/signkey.pem)
     """,
     visibility = [
-        "//metropolis/test/launch:__subpackages__",
         "//metropolis/test/e2e:__subpackages__",
+        "//metropolis/test/launch:__subpackages__",
     ],
 )
 
diff --git a/metropolis/node/core/consensus/consensus.go b/metropolis/node/core/consensus/consensus.go
index c8fb9b5..f0a2e22 100644
--- a/metropolis/node/core/consensus/consensus.go
+++ b/metropolis/node/core/consensus/consensus.go
@@ -198,7 +198,7 @@
 			return fmt.Errorf("when issuing new cluster's first certificate: %w", err)
 		}
 
-		if err := s.config.Data.PeerPKI.MkdirAll(0600); err != nil {
+		if err := s.config.Data.PeerPKI.MkdirAll(0700); err != nil {
 			return fmt.Errorf("when creating PKI directory: %w", err)
 		}
 		if err := s.config.Data.PeerPKI.CACertificate.Write(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: st.ca.CACertRaw}), 0600); err != nil {
@@ -221,7 +221,7 @@
 		}
 	}
 
-	if err := s.config.Data.MkdirAll(0600); err != nil {
+	if err := s.config.Data.MkdirAll(0700); err != nil {
 		return fmt.Errorf("failed to create data directory; %w", err)
 	}
 
diff --git a/metropolis/node/core/consensus/consensus_test.go b/metropolis/node/core/consensus/consensus_test.go
index f6526c9..5729bc1 100644
--- a/metropolis/node/core/consensus/consensus_test.go
+++ b/metropolis/node/core/consensus/consensus_test.go
@@ -42,7 +42,10 @@
 func prep(t *testing.T) *boilerplate {
 	ctx, ctxC := context.WithCancel(context.Background())
 	root := &localstorage.Root{}
-	tmp, err := ioutil.TempDir("", "metropolis-consensus-test")
+	// Force usage of /tmp as temp directory root, otherwsie TMPDIR from Bazel
+	// returns a path long enough that socket binds in the localstorage fail
+	// (as socket names are limited to 108 characters).
+	tmp, err := ioutil.TempDir("/tmp", "metropolis-consensus-test")
 	if err != nil {
 		t.Fatal(err)
 	}