diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cce7adbcc0..cb982f083f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,6 +46,4 @@ jobs:
       - name: "🏋️‍♂️ Run snapshot tests"
         run: rm log && ./bazel test //test/scip --config=dbg
       - name: "🏋️‍♂️ Run repo tests"
-        run: ./bazel test //test/scip/repos --test_env GITHUB_ACTIONS=1 --test_env PATH="$PATH" --test_env HOME="$HOME" --config=dbg --spawn_strategy=local
-          # Turn off sandboxing because Homebrew needs to write
-          # to directories outside the sandbox. 🙄
+        run: ./bazel test //test/scip/repos --test_env GITHUB_ACTIONS=1 --test_env GEM_PATH="$(dirname "$(which gem)")" --config=dbg
diff --git a/.tool-versions b/.tool-versions
index 44d859d8d6..9eb38ed717 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1 +1 @@
-ruby 2.7.0
+ruby 2.7.2
diff --git a/scip-ruby-CONTRIBUTING.md b/scip-ruby-CONTRIBUTING.md
index 76684eb211..960b94c817 100644
--- a/scip-ruby-CONTRIBUTING.md
+++ b/scip-ruby-CONTRIBUTING.md
@@ -71,11 +71,26 @@ Updating snapshots:
 Run repo tests, to check that there are no crashes on indexing OSS repos:
 
 ```
-./bazel test //test/scip/repos --config=dbg
+# If Ruby was installed via asdf (recommended to avoid dependency on system Ruby on macOS)
+./bazel test --test_env GEM_PATH="$HOME/.asdf/installs/ruby/2.7.2/bin" //test/scip/repos --config=dbg
+
+# Otherwise, I think this might work.
+./bazel test --test_env GEM_PATH="$(dirname "$(which gem)")" //test/scip/repos --config=dbg
 ```
 
 This may take a few minutes to run.
 
+<details>
+  <summary>Known testing issues</summary>
+
+  1. On macOS, Ruby 2.7.x may fail to install due to a combination of `-Werror`
+     and a warning in OpenSSL. As a workaround, you can use the following asdf invocation:
+     ```
+     OPENSSL_CFLAGS=-Wno-error=implicit-function-declaration asdf install ruby 2.7.2
+     ```
+     This works with 2.7.2, but not with 2.7.0.
+</details>
+
 ## Writing a new snapshot test
 
 See the existings tests under `test/scip/testdata`
diff --git a/test/scip/repos/index_oss_repo.sh b/test/scip/repos/index_oss_repo.sh
index 2af179ae82..ad2902665b 100755
--- a/test/scip/repos/index_oss_repo.sh
+++ b/test/scip/repos/index_oss_repo.sh
@@ -1,5 +1,23 @@
 #!/usr/bin/env bash
 
+# Some tests populate caches based on $HOME. To avoid polluting
+# the outside env, such as on a dev machine, use the current
+# directory, as this script is invoked inside a temporary
+# test directory by Bazel.
+export HOME="$PWD"
+
+# GEM_PATH should be provided from outside:
+#
+#   ./bazel test --test_env GEM_PATH="$(dirname "$(which gem)")" <blah>
+#
+# Avoid passing --test_env PATH="$PATH" to reduce risk of
+# dependencies on random stuff in a dev environment.
+if [ -z "$GEM_PATH" ]; then
+  echo '$GEM_PATH environment variable was not set.'
+  exit 1
+fi
+export PATH="$GEM_PATH:$PATH"
+
 get_date() {
   date '+%s'
 }
@@ -38,8 +56,8 @@ PREP_CMD="$5"
 RUN_CMD="$6"
 PATCH_ABSPATH=""
 TEST_DIR="$PWD"
-if [ "$#" -eq 6 ]; then
-  PATCH_ABSPATH="$TEST_DIR/$6"
+if [ "$#" -eq 7 ]; then
+  PATCH_ABSPATH="$TEST_DIR/$7"
 fi
 
 if [ -n "${GITHUB_ACTIONS:-}" ]; then
@@ -51,7 +69,7 @@ rm -rf repo
 mkdir repo
 pushd repo
 
-git clone -q "$CLONE_URL" . --branch "$GIT_TAG" --depth=1
+git -c advice.detachedHead=false clone "$CLONE_URL" . --branch "$GIT_TAG" --depth=1
 if [ "$(git rev-parse HEAD)" != "$GIT_SHA" ]; then
   echo "Expected SHA: $GIT_SHA"
   echo "Obtained SHA: $(git rev-parse HEAD)"
diff --git a/test/scip/repos/scip_repos_test.bzl b/test/scip/repos/scip_repos_test.bzl
index c005aae952..ab21fe30db 100644
--- a/test/scip/repos/scip_repos_test.bzl
+++ b/test/scip/repos/scip_repos_test.bzl
@@ -9,7 +9,7 @@ _data = [
                      " && popd" +
                      " && ./bin/brew typecheck"),
         "run_cmd": ("pushd Library/Homebrew" +
-                    " && $$(find . -name srb -type f) | while IFS= read -r line ; do cp $${TEST_DIR}/$(location //main:scip-ruby) $$line ; done" +
+                    " && find . -name srb -type f -exec cp $${TEST_DIR}/$(location //main:scip-ruby) {} \\;" +
                     " && popd" +
                     " && ./bin/brew typecheck"),
     },