@@ -309,12 +309,6 @@ The `--bazel-scip-java-binary` argument is required due to implementation
 details, scip-java runs an [aspect](https://bazel.build/extending/aspects) that
 requires the absolute path to the `scip-java` binary.
 
-> The current solution for automatic indexing step is not yet 100% hermetic and,
-> therefore, relies on `--spawn_strategy=local` under the hood. Depending on
-> your use-case, this might be OK or not. If there is demand for it, it's should
-> be possible to make the indexing fully hermetic and compatible with Bazel's
-> sandbox with some extra work.
-
 #### Manual - `select`
 
 It's possible to index Bazel codebases by integrating scip-java directly into
 
@@ -65,13 +65,9 @@ class BazelBuildTool(index: IndexCommand) : BuildTool("Bazel", index) {
                 bazelExecutable,
                 "build",
                 "--noshow_progress",
-                // The local strategy is required for now because we write
-                // SCIP and SCIP files to the provided targetroot directory.
-                "--spawn_strategy=local",
                 "--aspects",
                 "$aspectLabel%scip_java_aspect",
                 "--output_groups=scip",
-                "--define=sourceroot=${index.workingDirectory}",
                 "--define=java_home=$javaHome",
                 "--define=scip_java_binary=$scipJavaBinary",
                 "--verbose_failures",
 
@@ -13,12 +13,6 @@ many *.scip (https://github.com/scip-code/scip) files.
 These files encode information about which symbols are referenced from which
 locations in your source code.
 
-This aspect only works on Linux when using the `local` spawn strategy because
-the `run_shell` action writes SCIP files to the provided
---targetroot argument. It should be possible to avoid this requirement
-in the future if there's a strong desire to make the aspect work with the
-default (sandboxed) spawn strategy.
-
 Use the command below to merge all of these SCIP files into a single index:
 
     find bazel-bin/ -type f -name '*.scip' | xargs cat > index.scip
@@ -33,7 +27,7 @@ Use `src code-intel upload` to upload the unified SCIP file to Sourcegraph:
 
 Example command to run this aspect directly:
 
-    bazel build //... --spawn_strategy=local  --aspects path/to/scip_java.bzl%scip_java_aspect --output_groups=scip --define=sourceroot=$(pwd) --define=scip_java_binary=$(which scip-java) --define=java_home=$JAVA_HOME
+    bazel build //... --aspects path/to/scip_java.bzl%scip_java_aspect --output_groups=scip --define=scip_java_binary=$(which scip-java) --define=java_home=$JAVA_HOME
 
 To learn more about aspects: https://bazel.build/extending/aspects
 """
@@ -136,12 +130,12 @@ def _scip_java(target, ctx):
     deps = [javac_action.inputs, annotations.processor_classpath]
 
     ctx.actions.run_shell(
-        # Prefix bazel-out paths with $PWD (the execroot) so they don't depend
-        # on the workspace-level bazel-out convenience symlink, which doesn't
-        # exist on a cold build.
-        command = "\"{}\" index --no-cleanup --aggregate.allow-empty-index --cwd \"{}\" --targetroot \"$PWD/{}\" --scip-config \"$PWD/{}\" --output \"$PWD/{}\"".format(
+        # The action runs in the execroot (sandboxed or not), so bazel-out
+        # paths resolve directly. Prefix them with $PWD to make them absolute,
+        # which keeps them unambiguous regardless of how scip-java resolves
+        # relative paths.
+        command = "\"{}\" index --no-cleanup --aggregate.allow-empty-index --targetroot \"$PWD/{}\" --scip-config \"$PWD/{}\" --output \"$PWD/{}\"".format(
             ctx.var["scip_java_binary"],
-            ctx.var["sourceroot"],
             targetroot.path,
             build_config_path.path,
             scip_output.path,