diff --git a/src/blacklist.rs b/src/blacklist.rs
index 7c406c7..48c4c2d 100644
--- a/src/blacklist.rs
+++ b/src/blacklist.rs
@@ -19,7 +19,9 @@ pub fn resolve_overlays(ctx: &PathContext) -> Result<BlacklistOverlays, SandboxE
 
     for raw in SENSITIVE_PATHS {
         let expanded = expand_path(raw, ctx);
-        for path in expand_glob(&expanded)? {
+        let mut paths = expand_glob(&expanded)?;
+        paths.sort_by_key(|p| !p.is_dir());
+        for path in paths {
             match classify_path(&path) {
                 PathKind::Dir => tmpfs_dirs.push(path),
                 PathKind::File => {