diff --git a/CHANGELOG.md b/CHANGELOG.md
index 457cdafa98d..7557e7b77c8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@
 
     This was contributed by [@lbwa](https://github.com/lbwa).
 
+* Ignore `EPERM` errors on directories ([#2261](https://github.com/evanw/esbuild/issues/2261))
+
+    Previously bundling with esbuild when inside a sandbox environment which does not have permission to access the parent directory did not work because esbuild would try to read the directory to search for a `node_modules` folder and would then fail the build when that failed. In practice this caused issues with running esbuild with `sandbox-exec` on macOS. With this release, esbuild will treat directories with permission failures as empty to allow for the `node_modules` search to continue past the denied directory and into its parent directory. This means it should now be possible to bundle with esbuild in these situations. This fix is similar to the fix in version 0.9.1 but is for `EPERM` while that fix was for `EACCES`.
+
 ## 0.14.39
 
 * Fix code generation for `export default` and `/* @__PURE__ */` call ([#2203](https://github.com/evanw/esbuild/issues/2203))
diff --git a/internal/resolver/resolver.go b/internal/resolver/resolver.go
index 8f0fc2abf70..eb59a824ace 100644
--- a/internal/resolver/resolver.go
+++ b/internal/resolver/resolver.go
@@ -1033,7 +1033,7 @@ func (r resolverQuery) dirInfoUncached(path string) *dirInfo {
 
 	// List the directories
 	entries, err, originalError := r.fs.ReadDirectory(path)
-	if err == syscall.EACCES {
+	if err == syscall.EACCES || err == syscall.EPERM {
 		// Just pretend this directory is empty if we can't access it. This is the
 		// case on Unix for directories that only have the execute permission bit
 		// set. It means we will just pass through the empty directory and