diff --git a/.bazelrc b/.bazelrc
index 496f91b705..35af4019d0 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -23,6 +23,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/examples/crate_universe/.bazelrc b/examples/crate_universe/.bazelrc
index 883f004db4..45fb82e3c8 100644
--- a/examples/crate_universe/.bazelrc
+++ b/examples/crate_universe/.bazelrc
@@ -26,6 +26,9 @@ build --nolegacy_external_runfiles
 # https://github.com/bazelbuild/bazel/issues/23043.
 build --incompatible_autoload_externally=
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Bzlmod
 ###############################################################################
diff --git a/extensions/bindgen/.bazelrc b/extensions/bindgen/.bazelrc
index a2e6587a8e..3749baf087 100644
--- a/extensions/bindgen/.bazelrc
+++ b/extensions/bindgen/.bazelrc
@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/extensions/mdbook/.bazelrc b/extensions/mdbook/.bazelrc
index a2e6587a8e..3749baf087 100644
--- a/extensions/mdbook/.bazelrc
+++ b/extensions/mdbook/.bazelrc
@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/extensions/prost/.bazelrc b/extensions/prost/.bazelrc
index a2e6587a8e..3749baf087 100644
--- a/extensions/prost/.bazelrc
+++ b/extensions/prost/.bazelrc
@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/extensions/protobuf/.bazelrc b/extensions/protobuf/.bazelrc
index a2e6587a8e..3749baf087 100644
--- a/extensions/protobuf/.bazelrc
+++ b/extensions/protobuf/.bazelrc
@@ -20,6 +20,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/extensions/wasm_bindgen/.bazelrc b/extensions/wasm_bindgen/.bazelrc
index 965ff4b0f1..668c440455 100644
--- a/extensions/wasm_bindgen/.bazelrc
+++ b/extensions/wasm_bindgen/.bazelrc
@@ -25,6 +25,9 @@ coverage --experimental_fetch_all_coverage_outputs
 # https://bazel.build/reference/command-line-reference#flag--experimental_cc_shared_library
 common --experimental_cc_shared_library
 
+# Disable network access in sandboxes by default.
+build --sandbox_default_allow_network=false
+
 ###############################################################################
 ## Unique configuration groups
 ###############################################################################
diff --git a/ffi/rs/allocator_library/empty.rs b/ffi/rs/allocator_library/empty.rs
index e69de29bb2..8b13789179 100644
--- a/ffi/rs/allocator_library/empty.rs
+++ b/ffi/rs/allocator_library/empty.rs
@@ -0,0 +1 @@
+
diff --git a/ffi/rs/global_allocator_library/empty.rs b/ffi/rs/global_allocator_library/empty.rs
index e69de29bb2..8b13789179 100644
--- a/ffi/rs/global_allocator_library/empty.rs
+++ b/ffi/rs/global_allocator_library/empty.rs
@@ -0,0 +1 @@
+
diff --git a/ffi/rs/global_allocator_library/global_allocator_library.rs b/ffi/rs/global_allocator_library/global_allocator_library.rs
index 44dbe88ea3..22ddeaf540 100644
--- a/ffi/rs/global_allocator_library/global_allocator_library.rs
+++ b/ffi/rs/global_allocator_library/global_allocator_library.rs
@@ -35,7 +35,6 @@ fn __rust_alloc_error_handler(size: usize, align: usize) {
     }
 }
 
-
 // New feature as of https://github.com/rust-lang/rust/pull/88098.
 // This symbol is normally emitted by rustc. 0 means OOMs should abort, 1 means OOMs should panic.
 #[linkage = "weak"]
diff --git a/test/cargo_build_script/build_script_env_files/build.rs b/test/cargo_build_script/build_script_env_files/build.rs
index 9b84abe967..5d4adacd62 100644
--- a/test/cargo_build_script/build_script_env_files/build.rs
+++ b/test/cargo_build_script/build_script_env_files/build.rs
@@ -1,3 +1,6 @@
 fn main() {
-    println!("cargo:rustc-env=FROM_BUILD_SCRIPT={}", std::env::var("GREETING").unwrap());
+    println!(
+        "cargo:rustc-env=FROM_BUILD_SCRIPT={}",
+        std::env::var("GREETING").unwrap()
+    );
 }
diff --git a/test/cargo_build_script/tools_exec/build.rs b/test/cargo_build_script/tools_exec/build.rs
index 1793750043..397281bd57 100644
--- a/test/cargo_build_script/tools_exec/build.rs
+++ b/test/cargo_build_script/tools_exec/build.rs
@@ -48,7 +48,8 @@ fn main() {
     for env_var in &["CARGO", "CC", "CXX", "LD", "RUSTC"] {
         let path = std::env::var(env_var)
             .unwrap_or_else(|err| panic!("Error getting {}: {}", env_var, err));
-        std::process::Command::new(&path).status()
+        std::process::Command::new(&path)
+            .status()
             .unwrap_or_else(|err| panic!("Error executing {}: {}", path, err));
     }