diff --git a/metallb/v0.14.5/controller/rockcraft.yaml b/metallb/v0.14.5/controller/rockcraft.yaml
index 504949c..3dac45e 100644
--- a/metallb/v0.14.5/controller/rockcraft.yaml
+++ b/metallb/v0.14.5/controller/rockcraft.yaml
@@ -6,7 +6,7 @@ description: >
 version: v0.14.5
 license: Apache-2.0
 
-base: ubuntu@22.04
+base: bare
 build-base: ubuntu@22.04
 platforms:
   amd64:
@@ -20,6 +20,22 @@ services:
     startup: enabled
 
 parts:
+  add-base-files:
+    plugin: nil
+    stage-packages:
+      # Original Dockerfile uses gcr.io/distroless/static:latest as a base.
+      # This image contains the following:
+      # https://github.com/GoogleContainerTools/distroless/blob/1533e54a73805ec13fe0cc68218fc7a215a0a6f7/base/README.md
+      - ca-certificates
+      - tzdata
+      - base-passwd
+
+  # Can't have stage packages and stage slices together, apparently.
+  add-base-slices:
+    plugin: nil
+    stage-packages:
+      - base-files_tmp
+
   build-deps:
     plugin: nil
     build-snaps:
diff --git a/metallb/v0.14.5/speaker/rockcraft.yaml b/metallb/v0.14.5/speaker/rockcraft.yaml
index 9757a1d..a1a8efe 100644
--- a/metallb/v0.14.5/speaker/rockcraft.yaml
+++ b/metallb/v0.14.5/speaker/rockcraft.yaml
@@ -6,7 +6,7 @@ description: >
 version: v0.14.5
 license: Apache-2.0
 
-base: ubuntu@22.04
+base: bare
 build-base: ubuntu@22.04
 platforms:
   amd64:
@@ -20,6 +20,27 @@ services:
     startup: enabled
 
 parts:
+  add-base-files:
+    plugin: nil
+    stage-packages:
+      # Original Dockerfile uses gcr.io/distroless/static:latest as a base.
+      # This image contains the following:
+      # https://github.com/GoogleContainerTools/distroless/blob/1533e54a73805ec13fe0cc68218fc7a215a0a6f7/base/README.md
+      - ca-certificates
+      - tzdata
+      - base-passwd
+      # Helm charts may expect the image to be able to copy some files.
+      - bash
+      - coreutils
+    override-build: |
+      ln -sf bash "${CRAFT_PART_INSTALL}/bin/sh"
+
+  # Can't have stage packages and stage slices together, apparently.
+  add-base-slices:
+    plugin: nil
+    stage-packages:
+      - base-files_tmp
+
   build-deps:
     plugin: nil
     build-snaps:
diff --git a/tests/sanity/test_metallb_controller.py b/tests/sanity/test_metallb_controller.py
index f29a23f..a4d4e47 100644
--- a/tests/sanity/test_metallb_controller.py
+++ b/tests/sanity/test_metallb_controller.py
@@ -27,4 +27,4 @@ def test_sanity():
     assert V0_14_5_EXPECTED_HELPSTR in docker_run.stderr
 
     # check rock filesystem
-    docker_util.ensure_image_contains_paths(rock.image, V0_14_5_EXPECTED_FILES)
+    docker_util.ensure_image_contains_paths_bare(rock.image, V0_14_5_EXPECTED_FILES)
diff --git a/tests/sanity/test_metallb_speaker.py b/tests/sanity/test_metallb_speaker.py
index 6cf821b..a48818a 100644
--- a/tests/sanity/test_metallb_speaker.py
+++ b/tests/sanity/test_metallb_speaker.py
@@ -27,4 +27,4 @@ def test_sanity():
     assert V0_14_5_EXPECTED_HELPSTR in docker_run.stderr
 
     # check rock filesystem
-    docker_util.ensure_image_contains_paths(rock.image, V0_14_5_EXPECTED_FILES)
+    docker_util.ensure_image_contains_paths_bare(rock.image, V0_14_5_EXPECTED_FILES)
diff --git a/tests/tox.ini b/tests/tox.ini
index 09d625d..b6689c6 100644
--- a/tests/tox.ini
+++ b/tests/tox.ini
@@ -40,11 +40,13 @@ commands =
     black {tox_root}/integration --check --diff
 
 [testenv:sanity]
-description = Run integration tests
+description = Run sanity tests
 deps =
     -r {tox_root}/requirements-test.txt
+allowlist_externals =
+    sudo
 commands =
-    pytest -v \
+    sudo -E {envpython} -m pytest -v \
         --maxfail 1 \
         --tb native \
         --log-cli-level DEBUG \