diff --git a/.bazelrc b/.bazelrc
index 546137f45a..77e9ef25cd 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,6 +1,9 @@
 # NOTE: These are mainly just for the BazelCI setup so they don't have
 # to be repeated multiple times in .bazelci/presubmit.yml.
 
+# https://github.com/bazelbuild/stardoc/issues/112
+common --incompatible_allow_tags_propagation
+
 # Force the tests to not run in sandboxed mode, since it can introduce
 # errors and flakes.
 test --spawn_strategy=local
diff --git a/doc/BUILD.bazel b/doc/BUILD.bazel
index 049140b136..a419424b77 100644
--- a/doc/BUILD.bazel
+++ b/doc/BUILD.bazel
@@ -30,6 +30,7 @@ _DOC_SRCS = [
         out = file + ".md",
         header_template = ":header.vm",
         input = "//apple:%s.bzl" % file,
+        tags = ["no-sandbox"],  # https://github.com/bazelbuild/stardoc/issues/112
         deps = ["//apple:" + file],
     )
     for file in _DOC_SRCS