diff --git a/metropolis/node/BUILD.bazel b/metropolis/node/BUILD.bazel
index 2da33e6..96c075c 100644
--- a/metropolis/node/BUILD.bazel
+++ b/metropolis/node/BUILD.bazel
@@ -38,7 +38,7 @@
 
         # runsc/gVisor
         "@com_github_google_gvisor//runsc": "/containerd/bin/runsc",
-        "@com_github_google_gvisor_containerd_shim//cmd/containerd-shim-runsc-v1": "/containerd/bin/containerd-shim-runsc-v1",
+        "@com_github_google_gvisor//shim/v2:containerd-shim-runsc-v1": "/containerd/bin/containerd-shim-runsc-v1",
 
         # runc (runtime in files_cc because of cgo)
         "@com_github_containerd_containerd//cmd/containerd-shim-runc-v2": "/containerd/bin/containerd-shim-runc-v2",
@@ -88,8 +88,8 @@
         "//metropolis/node/build/mkimage",
     ],
     visibility = [
-        "//metropolis/test/launch:__subpackages__",
         "//metropolis/test/e2e:__subpackages__",
+        "//metropolis/test/launch:__subpackages__",
     ],
 )
 
@@ -131,8 +131,8 @@
     cp tpm/ca/signkey.pem $(location tpm/signkey.pem)
     """,
     visibility = [
-        "//metropolis/test/launch:__subpackages__",
         "//metropolis/test/e2e:__subpackages__",
+        "//metropolis/test/launch:__subpackages__",
     ],
 )
 
diff --git a/metropolis/node/core/consensus/consensus.go b/metropolis/node/core/consensus/consensus.go
index c8fb9b5..f0a2e22 100644
--- a/metropolis/node/core/consensus/consensus.go
+++ b/metropolis/node/core/consensus/consensus.go
@@ -198,7 +198,7 @@
 			return fmt.Errorf("when issuing new cluster's first certificate: %w", err)
 		}
 
-		if err := s.config.Data.PeerPKI.MkdirAll(0600); err != nil {
+		if err := s.config.Data.PeerPKI.MkdirAll(0700); err != nil {
 			return fmt.Errorf("when creating PKI directory: %w", err)
 		}
 		if err := s.config.Data.PeerPKI.CACertificate.Write(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: st.ca.CACertRaw}), 0600); err != nil {
@@ -221,7 +221,7 @@
 		}
 	}
 
-	if err := s.config.Data.MkdirAll(0600); err != nil {
+	if err := s.config.Data.MkdirAll(0700); err != nil {
 		return fmt.Errorf("failed to create data directory; %w", err)
 	}
 
diff --git a/metropolis/node/core/consensus/consensus_test.go b/metropolis/node/core/consensus/consensus_test.go
index f6526c9..5729bc1 100644
--- a/metropolis/node/core/consensus/consensus_test.go
+++ b/metropolis/node/core/consensus/consensus_test.go
@@ -42,7 +42,10 @@
 func prep(t *testing.T) *boilerplate {
 	ctx, ctxC := context.WithCancel(context.Background())
 	root := &localstorage.Root{}
-	tmp, err := ioutil.TempDir("", "metropolis-consensus-test")
+	// Force usage of /tmp as temp directory root, otherwsie TMPDIR from Bazel
+	// returns a path long enough that socket binds in the localstorage fail
+	// (as socket names are limited to 108 characters).
+	tmp, err := ioutil.TempDir("/tmp", "metropolis-consensus-test")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/metropolis/pkg/fsquota/BUILD.bazel b/metropolis/pkg/fsquota/BUILD.bazel
index 58b2a0b..f4e11d3 100644
--- a/metropolis/pkg/fsquota/BUILD.bazel
+++ b/metropolis/pkg/fsquota/BUILD.bazel
@@ -28,12 +28,12 @@
 )
 
 ktest(
+    cmdline = "ramdisk_size=51200",
+    initramfs_extra = """
+file /mkfs.xfs $(location //third_party/xfsprogs:mkfs.xfs) 0755 0 0
+    """,
     tester = ":go_default_test",
     deps = [
         "//third_party/xfsprogs:mkfs.xfs",
     ],
-    initramfs_extra = """
-file /mkfs.xfs $(location //third_party/xfsprogs:mkfs.xfs) 0755 0 0
-    """,
-    cmdline = "ramdisk_size=51200",
 )
diff --git a/metropolis/test/e2e/k8s_cts/BUILD.bazel b/metropolis/test/e2e/k8s_cts/BUILD.bazel
index fc2ab84..afad6bc 100644
--- a/metropolis/test/e2e/k8s_cts/BUILD.bazel
+++ b/metropolis/test/e2e/k8s_cts/BUILD.bazel
@@ -45,8 +45,8 @@
     data = [
         "//metropolis/node:image",
         "//metropolis/node:swtpm_data",
-        "//metropolis/test/nanoswitch:initramfs",
         "//metropolis/test/ktest:linux-testing",
+        "//metropolis/test/nanoswitch:initramfs",
         "//third_party/edk2:firmware",
         "@com_github_bonzini_qboot//:qboot-bin",
     ],
diff --git a/metropolis/test/launch/cli/launch-multi2/BUILD.bazel b/metropolis/test/launch/cli/launch-multi2/BUILD.bazel
index 743dff9..91efdd7 100644
--- a/metropolis/test/launch/cli/launch-multi2/BUILD.bazel
+++ b/metropolis/test/launch/cli/launch-multi2/BUILD.bazel
@@ -20,8 +20,8 @@
     data = [
         "//metropolis/node:image",
         "//metropolis/node:swtpm_data",
-        "//metropolis/test/nanoswitch:initramfs",
         "//metropolis/test/ktest:linux-testing",
+        "//metropolis/test/nanoswitch:initramfs",
         "//third_party/edk2:firmware",
         "@com_github_bonzini_qboot//:qboot-bin",
     ],