diff --git a/cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go b/cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go
index 18cf4e1c..e35da8ae 100644
--- a/cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go
+++ b/cmd/nvidia-cdi-hook/update-ldcache/update-ldcache.go
@@ -109,14 +109,20 @@ func (m command) run(c *cli.Context, cfg *options) error {
 	}
 
 	containerRootDir, err := s.GetContainerRoot()
-	if err != nil {
+	if err != nil || containerRootDir == "" || containerRootDir == "/" {
 		return fmt.Errorf("failed to determined container root: %v", err)
 	}
 
 	ldconfigPath := m.resolveLDConfigPath(cfg.ldconfigPath)
-	args := []string{filepath.Base(ldconfigPath)}
-	if containerRootDir != "" {
-		args = append(args, "-r", containerRootDir)
+	args := []string{
+		filepath.Base(ldconfigPath),
+		// Run ldconfig in the container root directory on the host.
+		"-r", containerRootDir,
+		// Explicitly specify using /etc/ld.so.conf since the host's ldconfig may
+		// be configured to use a different config file by default.
+		// Note that since we apply the `-r {{ .containerRootDir }}` argument, /etc/ld.so.conf is
+		// in the container.
+		"-f", "/etc/ld.so.conf",
 	}
 
 	containerRoot := containerRoot(containerRootDir)
@@ -138,10 +144,6 @@ func (m command) run(c *cli.Context, cfg *options) error {
 		args = append(args, folders...)
 	}
 
-	// Explicitly specify using /etc/ld.so.conf since the host's ldconfig may
-	// be configured to use a different config file by default.
-	args = append(args, "-f", "/etc/ld.so.conf")
-
 	return m.SafeExec(ldconfigPath, args, nil)
 }