diff --git a/py/tests/py_venv_image_layer/my_app_amd64_layers_listing.yaml b/py/tests/py_venv_image_layer/my_app_amd64_layers_listing.yaml
index 7bc78804..77a8877f 100644
--- a/py/tests/py_venv_image_layer/my_app_amd64_layers_listing.yaml
+++ b/py/tests/py_venv_image_layer/my_app_amd64_layers_listing.yaml
@@ -2510,7 +2510,7 @@ files:
   - drwxr-xr-x  0 0      0           0 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/
   - drwxr-xr-x  0 0      0           0 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/
   - drwxr-xr-x  0 0      0           0 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/
-  - -rwxr-xr-x  0 0      0        8099 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/activate
+  - -rwxr-xr-x  0 0      0        8620 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/activate
   - -rwxr-xr-x  0 0      0      817416 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/python
   - -rwxr-xr-x  0 0      0      817416 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/python3
   - -rwxr-xr-x  0 0      0      817416 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/python3.9
diff --git a/py/tests/py_venv_image_layer/my_app_arm64_layers_listing.yaml b/py/tests/py_venv_image_layer/my_app_arm64_layers_listing.yaml
index 0a56adb5..c0911796 100644
--- a/py/tests/py_venv_image_layer/my_app_arm64_layers_listing.yaml
+++ b/py/tests/py_venv_image_layer/my_app_arm64_layers_listing.yaml
@@ -2491,7 +2491,7 @@ files:
   - drwxr-xr-x  0 0      0           0 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/
   - drwxr-xr-x  0 0      0           0 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/
   - drwxr-xr-x  0 0      0           0 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/
-  - -rwxr-xr-x  0 0      0        8100 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/activate
+  - -rwxr-xr-x  0 0      0        8621 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/activate
   - -rwxr-xr-x  0 0      0      698064 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/python
   - -rwxr-xr-x  0 0      0      698064 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/python3
   - -rwxr-xr-x  0 0      0      698064 Jan  1  2023 ./py/tests/py_venv_image_layer/my_app_bin.runfiles/aspect_rules_py/py/tests/py_venv_image_layer/.my_app_bin/bin/python3.9
diff --git a/py/tools/py/src/activate.tmpl b/py/tools/py/src/activate.tmpl
index 06e17477..13ab0775 100644
--- a/py/tools/py/src/activate.tmpl
+++ b/py/tools/py/src/activate.tmpl
@@ -70,7 +70,7 @@ export PYTHONEXECUTABLE
 # unset PYTHONHOME if set
 # this will fail if PYTHONHOME is set to the empty string (which is bad anyway)
 # could use `if (set -u; : $PYTHONHOME) ;` in bash.
-_OLD_VIRTUAL_PYTHONHOME="${PYTHONHOME:-}"
+_OLD_VIRTUAL_PYTHONHOME="${PYTHONHOME:-_activate_undef}"
 unset PYTHONHOME
 
 _OLD_VIRTUAL_PATH="$PATH"
@@ -85,6 +85,24 @@ _OLD_VIRTUAL_PATH="$PATH"
 # can provide some fallback handling around runfiles too.
 {{RUNFILES_INTERPRETER}}
 
+_abspath() {
+    "${PYTHONEXECUTABLE}" -c 'import os, sys; print(os.path.abspath(sys.argv[1]))' "$@"
+}
+
+# Re-export abspath'd vars
+# This allows us to avoid relative path issues without incurring sandbox escapes
+VIRTUAL_ENV="$(_abspath "${VIRTUAL_ENV}")"
+export VIRTUAL_ENV
+
+PYTHONEXECUTABLE="$(_abspath "${PYTHONEXECUTABLE}")"
+export PYTHONEXECUTABLE
+
+if [ -n "${PYTHONHOME:-}" ]; then
+  PYTHONHOME="$(_abspath "${PYTHONHOME}")"
+  export PYTHONHOME
+fi
+
+# Now we can put the venv's absolute bin on the path
 PATH="$VIRTUAL_ENV/bin:$PATH"
 export PATH
 
diff --git a/py/tools/py/src/runfiles_interpreter.tmpl b/py/tools/py/src/runfiles_interpreter.tmpl
index f53de4f3..1aea2ec7 100644
--- a/py/tools/py/src/runfiles_interpreter.tmpl
+++ b/py/tools/py/src/runfiles_interpreter.tmpl
@@ -1,4 +1,4 @@
-# --- Runfiles-based interpreter setup --
+# --- Runfiles-based interpreter setup ---
 
 # If the runfiles dir is unset AND we will fail to find a runfiles manifest
 # based on inspecting $0, we need to try something different.
@@ -22,7 +22,7 @@ _activate_find_runfiles() {
        # find the manifest file and runfiles tree relative to the execroot.
 
        # HACK: We can't lazy-match to the first /bin/, so we have to manually count four groups
-       EXECROOT="$(echo "${1}" | sed 's/\(execroot\/[^\/]*\/[^\/]*\/[^\/]*\/[^\/]*\/\).*$/\1/' )"
+       EXECROOT="$(echo "${1}" | sed 's/\(execroot\/[^\/]*\/[^\/]*\/[^\/]*\/[^\/]*\).*$/\1/' )"
        export RUNFILES_DIR="${EXECROOT}/${RUNFILES_PATH}"
     elif [[ "${1}" == *.runfiles/* ]]; then
        # Examples:
diff --git a/py/tools/venv_shim/src/main.rs b/py/tools/venv_shim/src/main.rs
index 0faf8180..9b05b4fa 100644
--- a/py/tools/venv_shim/src/main.rs
+++ b/py/tools/venv_shim/src/main.rs
@@ -170,7 +170,7 @@ fn main() -> miette::Result<()> {
     {
         eprintln!("[aspect] Found potential Python interpreters in PATH with matching version:");
         for exe in &python_executables {
-            println!("[aspect] - {:?}", exe);
+            eprintln!("[aspect] - {:?}", exe);
         }
     }