diff --git a/cmd/buildlet/buildlet.go b/cmd/buildlet/buildlet.go
index 2c9971e..3dce7b7 100644
--- a/cmd/buildlet/buildlet.go
+++ b/cmd/buildlet/buildlet.go
@@ -1655,10 +1655,7 @@
 	// TODO: setup RAM disk for tmp and set *workDir
 
 	disableMacScreensaver()
-
-	// Enable developer mode for runtime tests. (Issue 31123)
-	// Best effort; ignore any error.
-	exec.Command("/usr/sbin/DevToolsSecurity", "-enable").Run()
+	enableMacDeveloperMode()
 
 	version, err := exec.Command("sw_vers", "-productVersion").Output()
 	if err != nil {
@@ -1710,6 +1707,30 @@
 	}
 }
 
+// enableMacDeveloperMode enables developer mode on macOS for the
+// runtime tests. (Issue 31123)
+//
+// It is best effort; errors are logged but otherwise ignored.
+func enableMacDeveloperMode() {
+	// Macs are configured with password-less sudo. Without sudo we get prompts
+	// that "SampleTools wants to make changes" that block the buildlet from starting.
+	// But oddly, not via gomote. Only during startup. The environment must be different
+	// enough that in one case macOS asks for permission (because it can use the GUI?)
+	// and in the gomote case (where the environment is largley scrubbed) it can't do
+	// the GUI dialog somehow and must just try to do it anyway and finds that passwordless
+	// sudo works. But using sudo seems to make it always work.
+	// For extra paranoia, use a context to not block start-up.
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "/usr/bin/sudo", "/usr/sbin/DevToolsSecurity", "-enable").CombinedOutput()
+	if err != nil {
+		log.Printf("Error enabling developer mode: %v, %s", err, out)
+		return
+	}
+	log.Printf("DevToolsSecurity: %s", out)
+}
+
 func vmwareGetInfo(key string) string {
 	cmd := exec.Command("/Library/Application Support/VMware Tools/vmware-tools-daemon",
 		"--cmd",