diff --git a/doc/manual/rl-next/build-dir-mandatory.md b/doc/manual/rl-next/build-dir-mandatory.md
new file mode 100644
index 000000000..a4b92f4a8
--- /dev/null
+++ b/doc/manual/rl-next/build-dir-mandatory.md
@@ -0,0 +1,12 @@
+---
+synopsis: "`build-dir` no longer defaults to `temp-dir`"
+cls: [3453]
+category: "Fixes"
+credits: [horrors]
+---
+
+The directory in which temporary build directories are created no longer defaults
+to the value of the `temp-dir` setting to avoid builders making their directories
+world-accessible. This behavior has been used to escape the build sandbox and can
+cause build impurities even when not used maliciously. We now default to `builds`
+in `NIX_STATE_DIR` (which is `/nix/var/nix/b` in the default configuration).
diff --git a/lix/libstore/settings/build-dir.md b/lix/libstore/settings/build-dir.md
index 738368622..020443f53 100644
--- a/lix/libstore/settings/build-dir.md
+++ b/lix/libstore/settings/build-dir.md
@@ -2,12 +2,12 @@
 name: build-dir
 internalName: buildDir
 settingType: PathsSetting<Path>
-defaultText: "`«nixStateDir»/builds`"
-defaultExpr: nixStateDir + "/builds"
+defaultText: "`«nixStateDir»/b`"
+defaultExpr: nixStateDir + "/b"
 ---
 The directory on the host, in which derivations' temporary build directories are created.
 
-If not set, Lix will use the `builds` subdirectory of its configured state directory.
+If not set, Lix will use the `b` subdirectory of its configured state directory.
 Lix will create this directory automatically with suitable permissions if it does not
 exist, otherwise its permissions must allow all users to traverse the directory (i.e.
 it must have `o+x` set, in unix parlance) for non-sandboxed builds to work correctly.
diff --git a/misc/systemd/nix-daemon.conf.in b/misc/systemd/nix-daemon.conf.in
index a0ddc4019..ee8087d24 100644
--- a/misc/systemd/nix-daemon.conf.in
+++ b/misc/systemd/nix-daemon.conf.in
@@ -1,2 +1,4 @@
 d @localstatedir@/nix/daemon-socket 0755 root root -  -
-d @localstatedir@/nix/builds        0755 root root 7d -
+d @localstatedir@/nix/b             0755 root root 7d -
+# TODO: Remove this after (at least) August 2026.
+R! @localstatedir@/nix/builds       -    -    -    -  -