diff --git a/src/main/java/com/google/devtools/build/lib/rules/cpp/HeaderDiscovery.java b/src/main/java/com/google/devtools/build/lib/rules/cpp/HeaderDiscovery.java
index c00c4f9dad64f6..40f1f71d461c48 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/cpp/HeaderDiscovery.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/cpp/HeaderDiscovery.java
@@ -189,6 +189,12 @@ private static NestedSet<Artifact> runDiscovery(
           inputs.add(artifact);
         }
         continue;
+      } else if (artifact == null && execPathFragment.getFileExtension().equals("cppmap")) {
+        // Transitive cppmap files are added to the dotd files of compiles even
+        // though they are not required for compilation. Since they're not
+        // explicit inputs to the action this only happens when sandboxing is
+        // disabled.
+        continue;
       }
 
       SpecialArtifact treeArtifact = findOwningTreeArtifact(execPathFragment, treeArtifacts);
diff --git a/src/test/shell/bazel/bazel_layering_check_test.sh b/src/test/shell/bazel/bazel_layering_check_test.sh
index 341f821f6a8f18..45ebede8ad3d61 100755
--- a/src/test/shell/bazel/bazel_layering_check_test.sh
+++ b/src/test/shell/bazel/bazel_layering_check_test.sh
@@ -166,6 +166,11 @@ function test_bazel_layering_check() {
     fail "module map files were not generated"
   fi
 
+  CC="${clang_tool}" bazel build \
+    //hello:hello --copt=-DFORCE_REBUILD=1 \
+    --spawn_strategy=local --features=layering_check \
+    &> "${TEST_log}" || fail "Build with layering_check failed without sandboxing"
+
   CC="${clang_tool}" bazel build \
     --copt=-D=private_header \
     //hello:hello --features=layering_check \