diff --git a/libssu/ssu.cpp b/libssu/ssu.cpp
index 7b50382..212ad8a 100644
--- a/libssu/ssu.cpp
+++ b/libssu/ssu.cpp
@@ -16,6 +16,7 @@
 #include <pwd.h>
 
 #include "ssu.h"
+#include "sandbox_p.h"
 #include "ssulog.h"
 #include "ssuvariables.h"
 #include "ssucoreconfig.h"
@@ -474,6 +475,8 @@ void Ssu::storeAuthorizedKeys(QByteArray data){
   } else
     return;
 
+  homePath = Sandbox::map(homePath);
+
   if (dir.exists(homePath + "/.ssh/authorized_keys")){
     ssuLog->print(LOG_DEBUG, QString(".ssh/authorized_keys already exists in %1")
                   .arg(homePath));
diff --git a/libssu/ssudeviceinfo.cpp b/libssu/ssudeviceinfo.cpp
index d37446a..bdc2a51 100644
--- a/libssu/ssudeviceinfo.cpp
+++ b/libssu/ssudeviceinfo.cpp
@@ -15,6 +15,7 @@ extern "C" {
 #include <boardname.h>
 }
 
+#include "sandbox_p.h"
 #include "ssudeviceinfo.h"
 #include "ssucoreconfig.h"
 #include "ssulog.h"
@@ -165,7 +166,7 @@ QString SsuDeviceInfo::deviceModel(){
   // check if the device can be identified by testing for a file
   foreach (const QString &key, keys){
     QString value = boardMappings->value(key).toString();
-    if (dir.exists(value)){
+    if (dir.exists(Sandbox::map(value))){
       cachedModel = key;
       break;
     }
@@ -224,7 +225,7 @@ QString SsuDeviceInfo::deviceModel(){
   */
 
   // check if the device can be identified by a string in /proc/cpuinfo
-  procCpuinfo.setFileName("/proc/cpuinfo");
+  procCpuinfo.setFileName(Sandbox::map("/proc/cpuinfo"));
   procCpuinfo.open(QIODevice::ReadOnly | QIODevice::Text);
   if (procCpuinfo.isOpen()){
     QTextStream in(&procCpuinfo);
diff --git a/libssu/ssurepomanager.cpp b/libssu/ssurepomanager.cpp
index c201fef..2162015 100644
--- a/libssu/ssurepomanager.cpp
+++ b/libssu/ssurepomanager.cpp
@@ -9,6 +9,7 @@
 #include <QRegExp>
 #include <QDirIterator>
 
+#include "sandbox_p.h"
 #include "ssudeviceinfo.h"
 #include "ssurepomanager.h"
 #include "ssucoreconfig.h"
@@ -152,7 +153,7 @@ void SsuRepoManager::update(){
   // assume configuration error if there are no device repos, and don't delete
   // anything, even in strict mode
   if ((deviceMode & Ssu::LenientMode) != Ssu::LenientMode && !repos.isEmpty()){
-    QDirIterator it(ZYPP_REPO_PATH, QDir::AllEntries|QDir::NoDot|QDir::NoDotDot);
+    QDirIterator it(Sandbox::map(ZYPP_REPO_PATH), QDir::AllEntries|QDir::NoDot|QDir::NoDotDot);
     while (it.hasNext()){
       it.next();
       if (it.fileName().left(4) != "ssu_"){
@@ -164,7 +165,7 @@ void SsuRepoManager::update(){
 
   // ... delete all ssu-managed repositories not valid for this device ...
   ssuFilters.append("ssu_*");
-  QDirIterator it(ZYPP_REPO_PATH, ssuFilters);
+  QDirIterator it(Sandbox::map(ZYPP_REPO_PATH), ssuFilters);
   while (it.hasNext()){
     QString f = it.next();
 
@@ -190,7 +191,7 @@ void SsuRepoManager::update(){
     }
 
     QString repoFilePath = QString("%1/ssu_%2_%3.repo")
-      .arg(ZYPP_REPO_PATH)
+      .arg(Sandbox::map(ZYPP_REPO_PATH))
       .arg(repo)
       .arg(rndMode ? "rnd" : "release");
 
diff --git a/ssuurlresolver/ssuurlresolver.cpp b/ssuurlresolver/ssuurlresolver.cpp
index be9dc25..30d9826 100644
--- a/ssuurlresolver/ssuurlresolver.cpp
+++ b/ssuurlresolver/ssuurlresolver.cpp
@@ -12,6 +12,7 @@
 #include <QStringList>
 #include <systemd/sd-journal.h>
 
+#include "libssu/sandbox_p.h"
 #include "libssu/ssulog.h"
 
 SsuUrlResolver::SsuUrlResolver(): QObject(){
@@ -30,7 +31,16 @@ void SsuUrlResolver::error(QString message){
   QCoreApplication::exit(1);
 }
 
-bool SsuUrlResolver::writeCredentials(QString filePath, QString credentialsScope){
+bool SsuUrlResolver::writeZyppCredentialsIfNeeded(QString credentialsScope){
+  QString filePath = Sandbox::map("/etc/zypp/credentials.d/" + credentialsScope);
+  QFileInfo credentialsFileInfo(filePath);
+
+  if (credentialsFileInfo.exists() &&
+      credentialsFileInfo.lastModified() > ssu.lastCredentialsUpdate()){
+    // zypp credentials up to date
+    return true;
+  }
+
   QFile credentialsFile(filePath);
   QPair<QString, QString> credentials = ssu.credentials(credentialsScope);
   SsuLog *ssuLog = SsuLog::instance();
@@ -126,12 +136,7 @@ void SsuUrlResolver::run(){
     QString credentialsScope = ssu.credentialsScope(repo, isRnd);
     if (!credentialsScope.isEmpty()){
       headerList.append(QString("credentials=%1").arg(credentialsScope));
-
-      QFileInfo credentialsFileInfo("/etc/zypp/credentials.d/" + credentialsScope);
-      if (!credentialsFileInfo.exists() ||
-          credentialsFileInfo.lastModified() <= ssu.lastCredentialsUpdate()){
-        writeCredentials(credentialsFileInfo.filePath(), credentialsScope);
-      }
+      writeZyppCredentialsIfNeeded(credentialsScope);
     } else
       ssuLog->print(LOG_DEBUG, "Skipping credential update due to missing credentials scope");
   }
diff --git a/ssuurlresolver/ssuurlresolver.h b/ssuurlresolver/ssuurlresolver.h
index db45d2e..ef65492 100644
--- a/ssuurlresolver/ssuurlresolver.h
+++ b/ssuurlresolver/ssuurlresolver.h
@@ -55,7 +55,7 @@ class SsuUrlResolver: public QObject {
     Ssu ssu;
     void error(QString message);
     void printJournal(int priority, QString message);
-    bool writeCredentials(QString filePath, QString credentialsScope);
+    bool writeZyppCredentialsIfNeeded(QString credentialsScope);
 
   public slots:
     void run();