diff --git a/.evergreen/hatch.sh b/.evergreen/hatch.sh
index db0da2f4d0..8f862c39d2 100644
--- a/.evergreen/hatch.sh
+++ b/.evergreen/hatch.sh
@@ -18,17 +18,22 @@ if [ -n "$SKIP_HATCH" ]; then
     run_hatch() {
       bash ./.evergreen/run-tests.sh
     }
-elif $PYTHON_BINARY -m hatch --version; then
-    run_hatch() {
-      $PYTHON_BINARY -m hatch run "$@"
-    }
-else # No toolchain hatch present, set up virtualenv before installing hatch
+else # Set up virtualenv before installing hatch
     # Use a random venv name because the encryption tasks run this script multiple times in the same run.
     ENV_NAME=hatchenv-$RANDOM
     createvirtualenv "$PYTHON_BINARY" $ENV_NAME
     # shellcheck disable=SC2064
     trap "deactivate; rm -rf $ENV_NAME" EXIT HUP
     python -m pip install -q hatch
+
+    # Ensure hatch does not write to user or global locations.
+    touch hatch_config.toml
+    HATCH_CONFIG=$(pwd)/hatch_config.toml
+    export HATCH_CONFIG
+    hatch config restore
+    hatch config set dirs.data ".hatch/data"
+    hatch config set dirs.cache ".hatch/cache"
+
     run_hatch() {
       python -m hatch run "$@"
     }