diff --git a/cmd/vulncheck_sandbox/vulncheck_sandbox.go b/cmd/vulncheck_sandbox/vulncheck_sandbox.go
index 700cfca..88b27b7 100644
--- a/cmd/vulncheck_sandbox/vulncheck_sandbox.go
+++ b/cmd/vulncheck_sandbox/vulncheck_sandbox.go
@@ -31,17 +31,11 @@
 	// file containing a timestamp.
 	vulnDBDir = flag.String("vulndb", "/go-vulndb", "directory of local vuln DB")
 
-	modCacheDir = flag.String("gomodcache", "", "override GOMODCACHE env var")
-
 	clean = flag.Bool("clean", false, "clean caches instead of running a module")
 )
 
 func main() {
 	flag.Parse()
-	if *modCacheDir != "" {
-		// Change the location of the module cache.
-		os.Setenv("GOMODCACHE", *modCacheDir)
-	}
 	if *clean {
 		cleanGoCaches()
 	} else {
diff --git a/internal/worker/vulncheck_scan.go b/internal/worker/vulncheck_scan.go
index d093428..53462b1 100644
--- a/internal/worker/vulncheck_scan.go
+++ b/internal/worker/vulncheck_scan.go
@@ -312,12 +312,15 @@
 	return unmarshalVulncheckOutput(stdout)
 }
 
-const sandboxGoModCache = "go/pkg/mod"
+// The Go module cache resides in its default location, $HOME/go/pkg/mod.
+// Inside the sandbox, the user is root and their home directory is /root.
+const sandboxGoModCache = "root/go/pkg/mod"
 
 func runSourceScanSandbox(ctx context.Context, modulePath, version, mode string, proxyClient *proxy.Client, sbox *sandbox.Sandbox) ([]byte, error) {
 	sandboxDir := "/modules/" + modulePath + "@" + version
 	imageDir := "/bundle/rootfs" + sandboxDir
 	defer os.RemoveAll(imageDir)
+
 	log.Infof(ctx, "downloading %s@%s to %s", modulePath, version, imageDir)
 	if err := modules.Download(ctx, modulePath, version, imageDir, proxyClient, true); err != nil {
 		log.Debugf(ctx, "download error: %v (%[1]T)", err)
@@ -338,7 +341,7 @@
 	}
 	log.Infof(ctx, "go mod download succeeded")
 	log.Infof(ctx, "%s@%s: running vulncheck in sandbox", modulePath, version)
-	stdout, err := sbox.Run(ctx, "/binaries/vulncheck_sandbox", "-gomodcache", "/"+sandboxGoModCache, mode, sandboxDir)
+	stdout, err := sbox.Run(ctx, "/binaries/vulncheck_sandbox", mode, sandboxDir)
 	if err != nil {
 		return nil, errors.New(derrors.IncludeStderr(err))
 	}
@@ -747,7 +750,7 @@
 	if s.insecure {
 		out, err = exec.Command("go", "clean", "-cache", "-modcache").CombinedOutput()
 	} else {
-		out, err = s.sbox.Run(ctx, "/binaries/vulncheck_sandbox", "-gomodcache", "/"+sandboxGoModCache, "-clean")
+		out, err = s.sbox.Run(ctx, "/binaries/vulncheck_sandbox", "-clean")
 	}
 	if err != nil {
 		return fmt.Errorf("cleaning Go caches: %s", derrors.IncludeStderr(err))