diff --git a/src/Sandbox.jl b/src/Sandbox.jl
index 76721ac..f0d6b15 100644
--- a/src/Sandbox.jl
+++ b/src/Sandbox.jl
@@ -51,7 +51,7 @@ include("Docker.jl")
 # Load the UserNamespace executor
 include("UserNamespaces.jl")
 
-all_executors = Type{<:SandboxExecutor}[
+const all_executors = Type{<:SandboxExecutor}[
     # We always prefer the UserNamespaces executor, if we can use it,
     # and the unprivileged one most of all.  Only after that do we try `docker`.
     UnprivilegedUserNamespacesExecutor,
@@ -89,16 +89,15 @@ function select_executor(verbose::Bool)
     error("Could not find any available executors for $(triplet(HostPlatform()))!")
 end
 
-_preferred_executor = nothing
+const _preferred_executor = Ref{Union{Nothing, (x->Type{x}).(all_executors)...}}(nothing)
 const _preferred_executor_lock = ReentrantLock()
 function preferred_executor(;verbose::Bool = false)
     lock(_preferred_executor_lock) do
         # If we've already asked this question, return the old answer
-        global _preferred_executor
-        if _preferred_executor === nothing
-            _preferred_executor = select_executor(verbose)
+        if _preferred_executor[] === nothing
+            _preferred_executor[] = select_executor(verbose)
         end
-        return _preferred_executor
+        return _preferred_executor[]
     end
 end
 
diff --git a/src/utils.jl b/src/utils.jl
index 6fbe58e..b4dd0c8 100644
--- a/src/utils.jl
+++ b/src/utils.jl
@@ -198,27 +198,26 @@ Wrapper around libc's `getuid()` function
 """
 getgid() = ccall(:getgid, Cint, ())
 
-_sudo_cmd = nothing
+const _sudo_cmd = Ref{Union{Vector{String}, Nothing}}(nothing)
 function sudo_cmd()
-    global _sudo_cmd
 
     # Use cached value if we've already run this
-    if _sudo_cmd !== nothing
-        return _sudo_cmd
+    if _sudo_cmd[] !== nothing
+        return _sudo_cmd[]
     end
 
-    if getuid() == 0
+    _sudo_cmd[] = if getuid() == 0
         # If we're already root, don't use any kind of sudo program
-        _sudo_cmd = String[]
+        String[]
     elseif Sys.which("sudo") !== nothing success(`sudo -V`)
         # If `sudo` is available, use that
-        _sudo_cmd = ["sudo"]
+        ["sudo"]
     elseif Sys.which("su") !== nothing
         # Fall back to `su` if all else fails
-        _sudo_cmd = ["su", "root", "-c"]
+        ["su", "root", "-c"]
     else
         @warn("No known sudo-like wrappers!")
-        _sudo_cmd = String[]
+        String[]
     end
-    return _sudo_cmd
+    return _sudo_cmd[]
 end
diff --git a/test/Sandbox.jl b/test/Sandbox.jl
index 8269ba3..7b471d3 100644
--- a/test/Sandbox.jl
+++ b/test/Sandbox.jl
@@ -1,6 +1,6 @@
 using Test, Sandbox, SHA
 
-all_executors = Sandbox.all_executors
+const all_executors = Sandbox.all_executors
 
 # Can we run `sudo` without a password?  If not, don't attempt to test the privileged runner
 if !success(`sudo -k -n true`)
@@ -17,7 +17,7 @@ function print_if_nonempty(stderr::Vector{UInt8})
     return true
 end
 
-rootfs_dir = Sandbox.alpine_rootfs()
+const rootfs_dir = Sandbox.alpine_rootfs()
 for executor in all_executors
     if !executor_available(executor)
         @error("Skipping $(executor) tests, as it does not seem to be available")
diff --git a/test/runtests.jl b/test/runtests.jl
index dde7470..f1e1bf8 100644
--- a/test/runtests.jl
+++ b/test/runtests.jl
@@ -1,6 +1,6 @@
 # If our test harness requests a local sandbox, make it so!
-REPO_ROOT = dirname(@__DIR__)
-should_build_local_sandbox = parse(Bool, get(ENV, "SANDBOX_BUILD_LOCAL_SANDBOX", "false"))
+const REPO_ROOT = dirname(@__DIR__)
+const should_build_local_sandbox = parse(Bool, get(ENV, "SANDBOX_BUILD_LOCAL_SANDBOX", "false"))
 if should_build_local_sandbox
     run(`$(Base.julia_cmd()) --project=$(REPO_ROOT) $(REPO_ROOT)/deps/build_local_sandbox.jl`)
     # Ensure LocalPreferences.toml gets used by test project as well
@@ -21,7 +21,7 @@ end
 using Test, Sandbox, Scratch
 
 # If we're on a UserNSSandbox_jll-compatible system, ensure that the sandbox is coming from where we expect.
-UserNSSandbox_jll = Sandbox.UserNSSandbox_jll
+using UserNSSandbox_jll
 if UserNSSandbox_jll.is_available()
     Artifacts = Sandbox.UserNSSandbox_jll.Artifacts
     sandbox_path = Sandbox.UserNSSandbox_jll.sandbox_path