diff --git a/tests/portal_test.zig b/tests/portal_test.zig
index a5c98e5..130a29a 100644
--- a/tests/portal_test.zig
+++ b/tests/portal_test.zig
@@ -55,22 +55,60 @@ const Seen = struct {
 
 const Bus = struct {
     daemon: std.process.Child,
+    /// Holds the daemon's configuration and its socket.
+    tmp: testing.TmpDir,
     address_buffer: [512]u8,
     address_len: usize,
 
+    /// Everything allowed: the bus is private to one test, and the fake
+    /// portal has to be allowed to own its name.
+    const config =
+        \\<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-Bus Bus Configuration 1.0//EN"
+        \\ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+        \\<busconfig>
+        \\  <type>session</type>
+        \\  <listen>unix:dir={s}</listen>
+        \\  <auth>EXTERNAL</auth>
+        \\  <policy context="default">
+        \\    <allow send_destination="*" eavesdrop="true"/>
+        \\    <allow eavesdrop="true"/>
+        \\    <allow own="*"/>
+        \\  </policy>
+        \\</busconfig>
+        \\
+    ;
+
+    /// Start a `dbus-daemon` of the test's own. It is given a configuration
+    /// file rather than `--session`, which reads the system's session
+    /// configuration from /etc -- present on a desktop, absent in a CI
+    /// container.
     fn start(io: Io) !Bus {
+        var tmp = testing.tmpDir(.{});
+        errdefer tmp.cleanup();
+        var dir_buffer: [std.fs.max_path_bytes]u8 = undefined;
+        const dir = dir_buffer[0..try tmp.dir.realPath(io, &dir_buffer)];
+
+        var config_buffer: [std.fs.max_path_bytes + 1024]u8 = undefined;
+        try tmp.dir.writeFile(io, .{
+            .sub_path = "bus.conf",
+            .data = try std.fmt.bufPrint(&config_buffer, config, .{dir}),
+        });
+        var config_path_buffer: [std.fs.max_path_bytes + 32]u8 = undefined;
+        const config_arg = try std.fmt.bufPrint(&config_path_buffer, "--config-file={s}/bus.conf", .{dir});
+
         var daemon = std.process.spawn(io, .{
-            .argv = &.{ "dbus-daemon", "--session", "--nofork", "--print-address=1", "--address=unix:tmpdir=/tmp" },
+            .argv = &.{ "dbus-daemon", config_arg, "--nofork", "--print-address=1" },
             .stdin = .ignore,
             .stdout = .pipe,
-            .stderr = .ignore,
+            // Left connected, so that a daemon that refuses to start says why.
+            .stderr = .inherit,
         }) catch |err| switch (err) {
             error.FileNotFound => return error.SkipZigTest,
             else => return err,
         };
         errdefer daemon.kill(io);
 
-        var bus: Bus = .{ .daemon = daemon, .address_buffer = undefined, .address_len = undefined };
+        var bus: Bus = .{ .daemon = daemon, .tmp = tmp, .address_buffer = undefined, .address_len = undefined };
         var read_buffer: [512]u8 = undefined;
         var reader = daemon.stdout.?.reader(io, &read_buffer);
         const line = try reader.interface.takeDelimiterInclusive('\n');
@@ -86,6 +124,7 @@ const Bus = struct {
 
     fn stop(self: *Bus, io: Io) void {
         self.daemon.kill(io);
+        self.tmp.cleanup();
     }
 };