diff --git a/clang/test/CAS/clang-cache-session-daemon.c b/clang/test/CAS/clang-cache-session-daemon.c
new file mode 100644
index 000000000000..bd12853c6437
--- /dev/null
+++ b/clang/test/CAS/clang-cache-session-daemon.c
@@ -0,0 +1,17 @@
+// Check that a depscan daemon spawned on demand can serve a compilation.
+// LLVM_CACHE_BUILD_SESSION_ID is what asks for one; the launcher turns it into
+// -fdepscan=daemon -fdepscan-share-identifier=<id>, and the client locates the
+// daemon under the system temporary directory before connecting to it.
+
+// REQUIRES: ondisk_cas
+// REQUIRES: clang-cc1daemon
+
+// RUN: rm -rf %t && mkdir -p %t
+
+// RUN: env LLVM_CACHE_CAS_PATH=%t/cas LLVM_CACHE_BUILD_SESSION_ID=%basename_t %clang-cache %clang -c %s -o %t/test.o -Xclang -Rcompile-job-cache 2>&1 | FileCheck %s -check-prefix=CACHE-MISS
+// RUN: env LLVM_CACHE_CAS_PATH=%t/cas LLVM_CACHE_BUILD_SESSION_ID=%basename_t %clang-cache %clang -c %s -o %t/test.o -Xclang -Rcompile-job-cache 2>&1 | FileCheck %s -check-prefix=CACHE-HIT
+
+// CACHE-MISS: remark: compile job cache miss
+// CACHE-HIT: remark: compile job cache hit
+
+int main() { return 0; }
diff --git a/clang/tools/driver/cc1depscanProtocol.cpp b/clang/tools/driver/cc1depscanProtocol.cpp
index ec45454879b5..e5b7fc2bc2da 100644
--- a/clang/tools/driver/cc1depscanProtocol.cpp
+++ b/clang/tools/driver/cc1depscanProtocol.cpp
@@ -13,6 +13,7 @@
 #include "llvm/Support/Allocator.h"
 #include "llvm/Support/Error.h"
 #include "llvm/Support/FileSystem.h"
+#include "llvm/Support/IOSandbox.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/Process.h"
 #include "llvm/Support/Signals.h"
@@ -33,6 +34,11 @@ using namespace llvm;
 std::string cc1depscand::getBasePath(StringRef DaemonKey) {
   assert(!DaemonKey.empty() && "Expected valid daemon key");
 
+  // Looking up the daemon's socket path is not compiler IO. On Windows,
+  // system_temp_directory() makes the path absolute, which the sandbox
+  // would reject.
+  auto BypassSandbox = llvm::sys::sandbox::scopedDisable();
+
   // Construct the path.
   SmallString<128> BasePath;
   llvm::sys::path::system_temp_directory(/*ErasedOnReboot=*/true, BasePath);
@@ -243,8 +249,14 @@ Expected<ScanDaemon> ScanDaemon::launchDaemon(StringRef BasePath,
   std::optional<ArrayRef<StringRef>> EnvOpt =
       Env.empty() ? std::nullopt : std::optional<ArrayRef<StringRef>>(Env);
 
-  llvm::sys::ProcessInfo PI = llvm::sys::ExecuteNoWait(
-      Arg0, LaunchArgs, EnvOpt, {}, 0, &ErrMsg, &ExecutionFailed);
+  llvm::sys::ProcessInfo PI = [&] {
+    // Starting the daemon is not compiler IO either. On Windows,
+    // ExecuteNoWait() checks that the program exists before launching it,
+    // and the sandbox would reject those checks.
+    auto BypassSandbox = llvm::sys::sandbox::scopedDisable();
+    return llvm::sys::ExecuteNoWait(Arg0, LaunchArgs, EnvOpt, {}, 0, &ErrMsg,
+                                    &ExecutionFailed);
+  }();
 
   if (ExecutionFailed || PI.Pid == llvm::sys::ProcessInfo::InvalidPid)
     return llvm::createStringError(std::make_error_code(std::errc::invalid_argument),