diff --git a/pkg/osutil/paths.go b/pkg/osutil/paths.go
index e841f44ec..5405daf9d 100644
--- a/pkg/osutil/paths.go
+++ b/pkg/osutil/paths.go
@@ -21,13 +21,17 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"strconv"
 	"strings"
 	"sync"
+
+	"camlistore.org/pkg/buildinfo"
 )
 
 // HomeDir returns the path to the user's home directory.
 // It returns the empty string if the value isn't known.
 func HomeDir() string {
+	failInTests()
 	if runtime.GOOS == "windows" {
 		return os.Getenv("HOMEDRIVE") + os.Getenv("HOMEPATH")
 	}
@@ -54,6 +58,7 @@ func cacheDir() string {
 	if d := os.Getenv("CAMLI_CACHE_DIR"); d != "" {
 		return d
 	}
+	failInTests()
 	switch runtime.GOOS {
 	case "darwin":
 		return filepath.Join(HomeDir(), "Library", "Caches", "Camlistore")
@@ -82,6 +87,7 @@ func makeCacheDir() {
 }
 
 func CamliVarDir() string {
+	failInTests()
 	switch runtime.GOOS {
 	case "windows":
 		return filepath.Join(os.Getenv("APPDATA"), "Camlistore")
@@ -92,6 +98,7 @@ func CamliVarDir() string {
 }
 
 func CamliBlobRoot() string {
+	failInTests()
 	return filepath.Join(CamliVarDir(), "blobs")
 }
 
@@ -99,6 +106,7 @@ func CamliConfigDir() string {
 	if p := os.Getenv("CAMLI_CONFIG_DIR"); p != "" {
 		return p
 	}
+	failInTests()
 	if runtime.GOOS == "windows" {
 		return filepath.Join(os.Getenv("APPDATA"), "Camlistore")
 	}
@@ -200,3 +208,10 @@ func GoPackagePath(pkg string) (path string, err error) {
 	}
 	return path, os.ErrNotExist
 }
+
+func failInTests() {
+	strict, _ := strconv.ParseBool(os.Getenv("CAMLI_STRICT_PATHS")) // temporary; will soon be always true
+	if strict && buildinfo.TestingLinked() {
+		panic("Unexpected non-hermetic use of host configuration during testing. (alternatively: the 'testing' package got accidentally linked in)")
+	}
+}