diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0bd184a..682558d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Added
+
+- Builds in the sandbox can now use `-Zbuild-std` when networking is disabled.
+  Previously, this would try to fetch the standard library sources, which would
+  error when networking was blocked. Note that you will still need to run
+  `toolchain.add_component("rust-src")` before trying to use build-std.
+
 ## [0.14.0] - 2021-08-19
 
 ### Added
diff --git a/src/prepare.rs b/src/prepare.rs
index bf4991a..5a7d212 100644
--- a/src/prepare.rs
+++ b/src/prepare.rs
@@ -139,9 +139,17 @@ impl<'a> Prepare<'a> {
 
     fn fetch_deps(&mut self) -> Result<(), Error> {
         let mut missing_deps = false;
-        let res = Command::new(self.workspace, self.toolchain.cargo())
+        let mut cmd = Command::new(self.workspace, self.toolchain.cargo())
             .args(&["fetch", "--manifest-path", "Cargo.toml"])
-            .cd(&self.source_dir)
+            .cd(&self.source_dir);
+        // Pass `-Zbuild-std` in case a build in the sandbox wants to use it;
+        // build-std has to have the source for libstd's dependencies available.
+        if self.workspace.fetch_build_std_dependencies() {
+            cmd = cmd
+                .args(&["-Zbuild-std"])
+                .env("__CARGO_TEST_CHANNEL_OVERRIDE_DO_NOT_USE_THIS", "nightly");
+        }
+        let res = cmd
             .process_lines(&mut |line, _| {
                 if line.contains("failed to load source for dependency") {
                     missing_deps = true;
diff --git a/src/workspace.rs b/src/workspace.rs
index 59c5ed1..7354a5e 100644
--- a/src/workspace.rs
+++ b/src/workspace.rs
@@ -27,6 +27,7 @@ pub struct WorkspaceBuilder {
     command_timeout: Option<Duration>,
     command_no_output_timeout: Option<Duration>,
     fetch_registry_index_during_builds: bool,
+    fetch_build_std_dependencies: bool,
     running_inside_docker: bool,
     fast_init: bool,
     rustup_profile: String,
@@ -45,6 +46,7 @@ impl WorkspaceBuilder {
             command_timeout: DEFAULT_COMMAND_TIMEOUT,
             command_no_output_timeout: DEFAULT_COMMAND_NO_OUTPUT_TIMEOUT,
             fetch_registry_index_during_builds: true,
+            fetch_build_std_dependencies: false,
             running_inside_docker: false,
             fast_init: false,
             rustup_profile: DEFAULT_RUSTUP_PROFILE.into(),
@@ -107,6 +109,19 @@ impl WorkspaceBuilder {
         self
     }
 
+    /// Enable or disable pre-fetching the dependencies for `-Z build-std` when preparing the sandbox (disabled by default).
+    ///
+    /// When this option is enabled, it is possible to use `-Zbuild-std` inside
+    /// the sandbox to build the standard library from source even when
+    /// networking is disabled. You will still need to run
+    /// `toolchain.add_component("rust-src")` before entering the sandbox.
+    #[cfg(any(feature = "unstable", doc))]
+    #[cfg_attr(docs_rs, doc(cfg(feature = "unstable")))]
+    pub fn fetch_build_std_dependencies(mut self, enable: bool) -> Self {
+        self.fetch_build_std_dependencies = enable;
+        self
+    }
+
     /// Enable or disable support for running Rustwide itself inside Docker (disabled by default).
     ///
     /// When support is enabled Rustwide will try to detect whether it's actually running inside a
@@ -160,6 +175,7 @@ impl WorkspaceBuilder {
                     command_timeout: self.command_timeout,
                     command_no_output_timeout: self.command_no_output_timeout,
                     fetch_registry_index_during_builds: self.fetch_registry_index_during_builds,
+                    fetch_build_std_dependencies: self.fetch_build_std_dependencies,
                     current_container: None,
                     rustup_profile: self.rustup_profile,
                 }),
@@ -183,6 +199,7 @@ struct WorkspaceInner {
     command_timeout: Option<Duration>,
     command_no_output_timeout: Option<Duration>,
     fetch_registry_index_during_builds: bool,
+    fetch_build_std_dependencies: bool,
     current_container: Option<CurrentContainer>,
     rustup_profile: String,
 }
@@ -299,6 +316,10 @@ impl Workspace {
         self.inner.fetch_registry_index_during_builds
     }
 
+    pub(crate) fn fetch_build_std_dependencies(&self) -> bool {
+        self.inner.fetch_build_std_dependencies
+    }
+
     pub(crate) fn current_container(&self) -> Option<&CurrentContainer> {
         self.inner.current_container.as_ref()
     }