diff --git a/build_image b/build_image
index 3fd2e3a..9075304 100755
--- a/build_image
+++ b/build_image
@@ -13,6 +13,14 @@
 # shellcheck source=build_library/build_common.sh
 . "${SCRIPT_ROOT}/build_library/build_common.sh" || exit 1
 
+# Make sure we run with network disabled to prevent leakage.
+if [[ -z ${UNSHARE} ]]; then
+  if [[ $(id -u) -ne 0 ]]; then
+    exec sudo -E env PATH="${PATH}" "$0" "$@"
+  fi
+  exec unshare -n -- sudo -E UNSHARE=true -u "${SUDO_USER}" -- "$0" "$@"
+fi
+
 # Developer-visible flags.
 DEFINE_string adjust_part "" \
   "Adjustments to apply to partition table (LABEL:[+-=]SIZE) e.g. ROOT-A:+1G"