diff --git a/java/droiddoc.go b/java/droiddoc.go
index 706111f..a892b36 100644
--- a/java/droiddoc.go
+++ b/java/droiddoc.go
@@ -1678,14 +1678,17 @@
 func zipSyncCmd(ctx android.ModuleContext, rule *android.RuleBuilder,
 	srcJarDir android.ModuleOutPath, srcJars android.Paths) android.OutputPath {
 
-	rule.Command().Text("rm -rf").Text(srcJarDir.String())
-	rule.Command().Text("mkdir -p").Text(srcJarDir.String())
+	cmd := rule.Command()
+	cmd.Text("rm -rf").Text(cmd.PathForOutput(srcJarDir))
+	cmd = rule.Command()
+	cmd.Text("mkdir -p").Text(cmd.PathForOutput(srcJarDir))
 	srcJarList := srcJarDir.Join(ctx, "list")
 
 	rule.Temporary(srcJarList)
 
-	rule.Command().BuiltTool("zipsync").
-		FlagWithArg("-d ", srcJarDir.String()).
+	cmd = rule.Command()
+	cmd.BuiltTool("zipsync").
+		FlagWithArg("-d ", cmd.PathForOutput(srcJarDir)).
 		FlagWithOutput("-l ", srcJarList).
 		FlagWithArg("-f ", `"*.java"`).
 		Inputs(srcJars)
diff --git a/java/java_test.go b/java/java_test.go
index b68945f..75813e0 100644
--- a/java/java_test.go
+++ b/java/java_test.go
@@ -25,12 +25,12 @@
 	"strings"
 	"testing"
 
-	"android/soong/genrule"
 	"github.com/google/blueprint/proptools"
 
 	"android/soong/android"
 	"android/soong/cc"
 	"android/soong/dexpreopt"
+	"android/soong/genrule"
 	"android/soong/python"
 )
 
@@ -1296,9 +1296,9 @@
 	})
 
 	foo := ctx.ModuleForTests("foo", "android_common")
-	rule := foo.Rule("lint")
 
-	if !strings.Contains(rule.RuleParams.Command, "--baseline lint-baseline.xml") {
+	sboxProto := android.RuleBuilderSboxProtoForTests(t, foo.Output("lint.sbox.textproto"))
+	if !strings.Contains(*sboxProto.Commands[0].Command, "--baseline lint-baseline.xml") {
 		t.Error("did not pass --baseline flag")
 	}
 }
@@ -1318,9 +1318,9 @@
        `, map[string][]byte{})
 
 	foo := ctx.ModuleForTests("foo", "android_common")
-	rule := foo.Rule("lint")
 
-	if strings.Contains(rule.RuleParams.Command, "--baseline") {
+	sboxProto := android.RuleBuilderSboxProtoForTests(t, foo.Output("lint.sbox.textproto"))
+	if strings.Contains(*sboxProto.Commands[0].Command, "--baseline") {
 		t.Error("passed --baseline flag for non existent file")
 	}
 }
@@ -1376,9 +1376,9 @@
 	})
 
 	foo := ctx.ModuleForTests("foo", "android_common")
-	rule := foo.Rule("lint")
 
-	if !strings.Contains(rule.RuleParams.Command, "--baseline mybaseline.xml") {
+	sboxProto := android.RuleBuilderSboxProtoForTests(t, foo.Output("lint.sbox.textproto"))
+	if !strings.Contains(*sboxProto.Commands[0].Command, "--baseline mybaseline.xml") {
 		t.Error("did not use the correct file for baseline")
 	}
 }
diff --git a/java/lint.go b/java/lint.go
index 9743c7a..938e2b0 100644
--- a/java/lint.go
+++ b/java/lint.go
@@ -218,7 +218,7 @@
 		// The list of resources may be too long to put on the command line, but
 		// we can't use the rsp file because it is already being used for srcs.
 		// Insert a second rule to write out the list of resources to a file.
-		resourcesList = android.PathForModuleOut(ctx, "lint", "resources.list")
+		resourcesList = android.PathForModuleOut(ctx, "resources.list")
 		resListRule := android.NewRuleBuilder(pctx, ctx)
 		resListRule.Command().Text("cp").
 			FlagWithRspFileInputList("", resourcesList.ReplaceExtension(ctx, "rsp"), l.resources).
@@ -233,7 +233,7 @@
 	cacheDir := android.PathForModuleOut(ctx, "lint", "cache")
 	homeDir := android.PathForModuleOut(ctx, "lint", "home")
 
-	srcJarDir := android.PathForModuleOut(ctx, "lint-srcjars")
+	srcJarDir := android.PathForModuleOut(ctx, "lint", "srcjars")
 	srcJarList := zipSyncCmd(ctx, rule, srcJarDir, l.srcJars)
 	// TODO(ccross): this is a little fishy.  The files extracted from the srcjars are referenced
 	// by the project.xml and used by the later lint rule, but the lint rule depends on the srcjars,
@@ -248,6 +248,7 @@
 		FlagWithRspFileInputList("", srcsListRsp, l.srcs).
 		Output(srcsList)
 	trackRSPDependency(l.srcs, srcsList)
+	rule.Temporary(srcsList)
 
 	cmd := rule.Command().
 		BuiltTool("lint-project-xml").
@@ -262,11 +263,11 @@
 		cmd.Flag("--test")
 	}
 	if l.manifest != nil {
-		cmd.FlagWithArg("--manifest ", l.manifest.String())
+		cmd.FlagWithArg("--manifest ", cmd.PathForInput(l.manifest))
 		trackInputDependency(l.manifest)
 	}
 	if l.mergedManifest != nil {
-		cmd.FlagWithArg("--merged_manifest ", l.mergedManifest.String())
+		cmd.FlagWithArg("--merged_manifest ", cmd.PathForInput(l.mergedManifest))
 		trackInputDependency(l.mergedManifest)
 	}
 
@@ -279,23 +280,17 @@
 	}
 
 	if l.classes != nil {
-		cmd.FlagWithArg("--classes ", l.classes.String())
+		cmd.FlagWithArg("--classes ", cmd.PathForInput(l.classes))
 		trackInputDependency(l.classes)
 	}
 
-	cmd.FlagForEachArg("--classpath ", l.classpath.Strings())
+	cmd.FlagForEachArg("--classpath ", cmd.PathsForInputs(l.classpath))
 	trackInputDependency(l.classpath...)
 
-	cmd.FlagForEachArg("--extra_checks_jar ", l.extraLintCheckJars.Strings())
+	cmd.FlagForEachArg("--extra_checks_jar ", cmd.PathsForInputs(l.extraLintCheckJars))
 	trackInputDependency(l.extraLintCheckJars...)
 
-	if ctx.Config().UseRBE() && ctx.Config().IsEnvTrue("RBE_LINT") &&
-		lintRBEExecStrategy(ctx) != remoteexec.LocalExecStrategy {
-		// TODO(b/181912787): remove these and use "." instead.
-		cmd.FlagWithArg("--root_dir ", "/b/f/w")
-	} else {
-		cmd.FlagWithArg("--root_dir ", "$PWD")
-	}
+	cmd.FlagWithArg("--root_dir ", "$PWD")
 
 	// The cache tag in project.xml is relative to the root dir, or the project.xml file if
 	// the root dir is not set.
@@ -325,7 +320,7 @@
 
 // generateManifest adds a command to the rule to write a simple manifest that contains the
 // minSdkVersion and targetSdkVersion for modules (like java_library) that don't have a manifest.
-func (l *linter) generateManifest(ctx android.ModuleContext, rule *android.RuleBuilder) android.Path {
+func (l *linter) generateManifest(ctx android.ModuleContext, rule *android.RuleBuilder) android.WritablePath {
 	manifestPath := android.PathForModuleOut(ctx, "lint", "AndroidManifest.xml")
 
 	rule.Command().Text("(").
@@ -356,18 +351,36 @@
 		}
 	}
 
-	rule := android.NewRuleBuilder(pctx, ctx)
+	rule := android.NewRuleBuilder(pctx, ctx).
+		Sbox(android.PathForModuleOut(ctx, "lint"),
+			android.PathForModuleOut(ctx, "lint.sbox.textproto")).
+		SandboxInputs()
+
+	if ctx.Config().UseRBE() && ctx.Config().IsEnvTrue("RBE_LINT") {
+		pool := ctx.Config().GetenvWithDefault("RBE_LINT_POOL", "java16")
+		rule.Remoteable(android.RemoteRuleSupports{RBE: true})
+		rule.Rewrapper(&remoteexec.REParams{
+			Labels:          map[string]string{"type": "tool", "name": "lint"},
+			ExecStrategy:    lintRBEExecStrategy(ctx),
+			ToolchainInputs: []string{config.JavaCmd(ctx).String()},
+			EnvironmentVariables: []string{
+				"LANG",
+			},
+			Platform: map[string]string{remoteexec.PoolKey: pool},
+		})
+	}
 
 	if l.manifest == nil {
 		manifest := l.generateManifest(ctx, rule)
 		l.manifest = manifest
+		rule.Temporary(manifest)
 	}
 
 	lintPaths := l.writeLintProjectXML(ctx, rule)
 
-	html := android.PathForModuleOut(ctx, "lint-report.html")
-	text := android.PathForModuleOut(ctx, "lint-report.txt")
-	xml := android.PathForModuleOut(ctx, "lint-report.xml")
+	html := android.PathForModuleOut(ctx, "lint", "lint-report.html")
+	text := android.PathForModuleOut(ctx, "lint", "lint-report.txt")
+	xml := android.PathForModuleOut(ctx, "lint", "lint-report.xml")
 
 	depSetsBuilder := NewLintDepSetBuilder().Direct(html, text, xml)
 
@@ -397,43 +410,7 @@
 		FlagWithInput("SDK_ANNOTATIONS=", annotationsZipPath).
 		FlagWithInput("LINT_OPTS=-DLINT_API_DATABASE=", apiVersionsXMLPath)
 
-	if ctx.Config().UseRBE() && ctx.Config().IsEnvTrue("RBE_LINT") {
-		pool := ctx.Config().GetenvWithDefault("RBE_LINT_POOL", "java16")
-		// TODO(b/181912787): this should be local fallback once the hack that passes /b/f/w in project.xml
-		// is removed.
-		execStrategy := lintRBEExecStrategy(ctx)
-		labels := map[string]string{"type": "tool", "name": "lint"}
-		rule.Remoteable(android.RemoteRuleSupports{RBE: true})
-		remoteInputs := lintPaths.remoteInputs
-		remoteInputs = append(remoteInputs,
-			lintPaths.projectXML,
-			lintPaths.configXML,
-			lintPaths.homeDir,
-			lintPaths.cacheDir,
-			ctx.Config().HostJavaToolPath(ctx, "lint.jar"),
-			annotationsZipPath,
-			apiVersionsXMLPath,
-		)
-
-		cmd.Text((&remoteexec.REParams{
-			Labels:          labels,
-			ExecStrategy:    execStrategy,
-			ToolchainInputs: []string{config.JavaCmd(ctx).String()},
-			Inputs:          remoteInputs.Strings(),
-			OutputFiles:     android.Paths{html, text, xml}.Strings(),
-			RSPFile:         strings.Join(lintPaths.remoteRSPInputs.Strings(), ","),
-			EnvironmentVariables: []string{
-				"JAVA_OPTS",
-				"ANDROID_SDK_HOME",
-				"SDK_ANNOTATIONS",
-				"LINT_OPTS",
-				"LANG",
-			},
-			Platform: map[string]string{remoteexec.PoolKey: pool},
-		}).NoVarTemplate(ctx.Config().RBEWrapper()))
-	}
-
-	cmd.BuiltTool("lint").
+	cmd.BuiltTool("lint").ImplicitTool(ctx.Config().HostJavaToolPath(ctx, "lint.jar")).
 		Flag("--quiet").
 		FlagWithInput("--project ", lintPaths.projectXML).
 		FlagWithInput("--config ", lintPaths.configXML).
@@ -450,6 +427,9 @@
 		Implicit(apiVersionsXMLPath).
 		Implicits(lintPaths.deps)
 
+	rule.Temporary(lintPaths.projectXML)
+	rule.Temporary(lintPaths.configXML)
+
 	if checkOnly := ctx.Config().Getenv("ANDROID_LINT_CHECK"); checkOnly != "" {
 		cmd.FlagWithArg("--check ", checkOnly)
 	}