Work around Cabal enforcing require-sandbox for update