diff --git a/pkg-r/R/run-r.R b/pkg-r/R/run-r.R
index 0caede0..fa4e16f 100644
--- a/pkg-r/R/run-r.R
+++ b/pkg-r/R/run-r.R
@@ -53,10 +53,15 @@ tool_run_r <- function(private) {
       "\n- Do not use this tool to talk to the user; explanations belong in your reply.",
       "\n- Return results implicitly (`x`, not `print(x)`) and prefer brief",
       "summaries (head(), summary()) over large outputs.",
+      "\n- The session can only write to its own temporary directory.",
       if (identical(private$worker$network, "none")) {
         "\n- The session has no network access."
-      },
-      "\n- The session can only write to its own temporary directory."
+      } else {
+        paste(
+          "\n- The temporary directory has been added to libPaths, so you",
+          "can use install.packages() normally."
+        )
+      }
     ),
     arguments = list(
       code = ellmer::type_string("The R code to run.")
@@ -856,6 +861,9 @@ worker_init <- function(
 ) {
   setwd(work_dir)
   options(width = 80, cli.num_colors = 1)
+  worker_lib <- file.path(work_dir, "library")
+  dir.create(worker_lib)
+  .libPaths(c(worker_lib, .libPaths()))
   if (!protection %in% c("sandbox", "guardrails")) {
     stop("unknown run_r protection mode: ", protection)
   }
diff --git a/pkg-r/tests/testthat/test-run-r.R b/pkg-r/tests/testthat/test-run-r.R
index cbe0b9e..1738cc8 100644
--- a/pkg-r/tests/testthat/test-run-r.R
+++ b/pkg-r/tests/testthat/test-run-r.R
@@ -53,6 +53,19 @@ test_that("run_r session state persists across calls, and handles sync lazily",
   expect_match(res@value, "48")
 })
 
+test_that("run_r prepends a worker-local package library", {
+  worker <- local_guardrail_worker()
+  worker_ensure(worker)
+
+  paths <- worker$rs$run(function() {
+    list(libraries = .libPaths(), bit64 = find.package("bit64"))
+  })
+
+  expect_equal(basename(paths$libraries[[1]]), "library")
+  expect_true(dir.exists(paths$libraries[[1]]))
+  expect_false(startsWith(paths$bit64, paths$libraries[[1]]))
+})
+
 test_that("run_r loads integer64 methods for stored handles", {
   skip_if_not_installed("bit64")
   worker <- local_worker()