diff --git a/pkg/worker/mount.go b/pkg/worker/mount.go
index 9588b7e8a..5450dd564 100644
--- a/pkg/worker/mount.go
+++ b/pkg/worker/mount.go
@@ -325,7 +325,7 @@ func (c *ContainerMountManager) setupUserCodeMount(ctx context.Context, request
 		return destPath, nil
 	}
 
-	if request.Stub.Type.IsSandbox() && abstractionscommon.IsEmptyStubObject(request.Stub.Object) {
+	if abstractionscommon.IsEmptyStubObject(request.Stub.Object) {
 		if err := createEmptyContainerWorkspace(destPath, readyPath); err != nil {
 			return "", err
 		}
diff --git a/pkg/worker/mount_test.go b/pkg/worker/mount_test.go
index 83c6bf440..62c017ac5 100644
--- a/pkg/worker/mount_test.go
+++ b/pkg/worker/mount_test.go
@@ -50,19 +50,35 @@ func bindMountRetryTestOps(clock *bindMountRetryTestClock, mkdirAll func(string,
 	return ops
 }
 
-func TestSetupContainerMountsUsesLocalWorkspaceForEmptySandbox(t *testing.T) {
-	manager := NewContainerMountManager(types.AppConfig{})
-	manager.codeCacheRoot = filepath.Join(t.TempDir(), "code-cache")
+func TestSetupContainerMountsUsesLocalWorkspaceForEmptyObject(t *testing.T) {
+	for _, stubType := range []types.StubType{"sandbox", "vm", "pod", "pod/deployment", "endpoint/deployment", "taskqueue/deployment"} {
+		t.Run(string(stubType), func(t *testing.T) {
+			manager := NewContainerMountManager(types.AppConfig{})
+			manager.codeCacheRoot = filepath.Join(t.TempDir(), "code-cache")
+
+			request := stubCodeMountRequest("empty-code-"+stubType.Kind(), "workspace-empty", "object-empty")
+			request.Stub.Type = stubType
+			request.Stub.Object.Hash = abstractionscommon.EmptyStubObjectHash()
+			t.Cleanup(func() { _ = os.RemoveAll(filepath.Dir(types.TempContainerWorkspace(request.ContainerId))) })
+
+			require.NoError(t, manager.SetupContainerMounts(context.Background(), request, discardLogger()))
+			require.DirExists(t, request.Mounts[0].LocalPath)
+			require.FileExists(t, filepath.Join(filepath.Dir(request.Mounts[0].LocalPath), ".workspace-ready"))
+			require.NoDirExists(t, manager.codeCacheRoot)
+		})
+	}
+}
 
-	request := stubCodeMountRequest("sandbox-empty-code", "workspace-empty", "object-empty")
-	request.Stub.Type = types.StubType(types.StubTypeSandbox)
-	request.Stub.Object.Hash = abstractionscommon.EmptyStubObjectHash()
+func TestSetupContainerMountsRejectsMissingNonemptyObject(t *testing.T) {
+	manager := NewContainerMountManager(types.AppConfig{})
+	manager.codeCacheRoot = t.TempDir()
+	request := stubCodeMountRequest("missing-service-code", "workspace-missing", "object-missing")
+	request.Stub.Type = "pod/deployment"
+	request.Stub.Object.Hash = "nonempty-object"
 	t.Cleanup(func() { _ = os.RemoveAll(filepath.Dir(types.TempContainerWorkspace(request.ContainerId))) })
 
-	require.NoError(t, manager.SetupContainerMounts(context.Background(), request, discardLogger()))
-	require.DirExists(t, request.Mounts[0].LocalPath)
-	require.FileExists(t, filepath.Join(filepath.Dir(request.Mounts[0].LocalPath), ".workspace-ready"))
-	require.NoDirExists(t, manager.codeCacheRoot)
+	require.Error(t, manager.SetupContainerMounts(context.Background(), request, discardLogger()))
+	require.NoFileExists(t, filepath.Join(filepath.Dir(types.TempContainerWorkspace(request.ContainerId)), ".workspace-ready"))
 }
 
 func TestEnsureBindMountSourceDirsRetriesWorkspaceEAGAIN(t *testing.T) {