EESSI
diff --git a/.github/workflows/tests_eessi_module.yml b/.github/workflows/tests_eessi_module.yml
@@ -115,7 +115,7 @@ jobs:
           # EESSI_MODULE_DEBUG_INIT/EESSI_ARCHDETECT_OPTIONS only relevant for Lmod init
           unset EESSI_MODULE_DEBUG_INIT
           # Store all relevant environment variables
-          env | grep -E '(^EESSI_|^LMOD_RC|^LMOD_PACKAGE_PATH|^MODULEPATH)' | grep -v EESSI_ARCHDETECT_OPTIONS | sort > "${moduleoutfile}"
+          env | grep -E '(^EESSI_|^LMOD_RC|^LMOD_PACKAGE_PATH|^MODULEPATH)' | grep -v EESSI_ARCHDETECT_OPTIONS | grep -v EESSI_DEFAULT_HOST_LD_LIBRARY_PATH | sort > "${moduleoutfile}"
           module unload EESSI/${{matrix.EESSI_VERSION}}
 
           # We should only have two EESSI_* variables defined (which set the overrides)
@@ -212,14 +212,14 @@ jobs:
           module unuse .github/workflows/modules
           module avail
 
-          # Store the initial environment (ignoring Lmod tables)
-          env | grep -v _ModuleTable | sort > "${initial_env_file}"
+          # Store the initial environment (ignoring Lmod tables and internal stack variables)
+          env | grep -v _ModuleTable | grep -v __LMOD_STACK | sort > "${initial_env_file}"
 
           # Do (and undo) loading the EESSI module
           CPU_ARCH=$(./init/eessi_archdetect.sh -a cpupath)
           module load EESSI/${{matrix.EESSI_VERSION}}
           module unload EESSI/${{matrix.EESSI_VERSION}}
-          env | grep -v _ModuleTable | sort > "${module_cycled_file}"
+          env | grep -v _ModuleTable | grep -v __LMOD_STACK |sort > "${module_cycled_file}"
 
           # Now compare the two results (do not expose the files, as they contain the full environment!)
           if (diff "${initial_env_file}" "${module_cycled_file}" > /dev/null); then
@@ -316,6 +316,46 @@ jobs:
           GREP_PATTERN="Lmod is automatically replacing \"EESSI/${{matrix.EESSI_VERSION}}\" with \"${LOCAL_STACK_NAME}/${LOCAL_STACK_VERSION}\"."
           module load "${LOCAL_STACK_NAME}/${LOCAL_STACK_VERSION}" |& grep "${GREP_PATTERN}"
 
+  check_ld_library_path_eessi_module:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        EESSI_VERSION:
+          - '2023.06'
+          - '2025.06'
+
+    steps:
+      - name: Check out software-layer repository
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+      - name: Mount EESSI CernVM-FS repository
+        uses: cvmfs-contrib/github-action-cvmfs@55899ca74cf78ab874bdf47f5a804e47c198743c # v4.0
+        with:
+          cvmfs_config_package: https://github.com/EESSI/filesystem-layer/releases/download/latest/cvmfs-config-eessi_latest_all.deb
+          cvmfs_http_proxy: DIRECT
+          cvmfs_repositories: software.eessi.io
+
+      - name: Make sure we are filtering LD_LIBRARY_PATH if necessary
+        run: |
+          # Initialise Lmod
+          . /cvmfs/software.eessi.io/versions/${{matrix.EESSI_VERSION}}/compat/linux/$(uname -m)/usr/share/Lmod/init/bash
+
+          # Make sure we are using the EESSI module file from the repository
+          export MODULEPATH=init/modules
+
+          # Create LD_LIBRARY_PATH to test with
+          export FAKE_PATH=/path/does/not/exist
+          export LMOD_CMD="env -u LD_LIBRARY_PATH $LMOD_CMD"  # Can't do this in reality
+          export INITIAL_LD_LIBRARY_PATH="/usr/lib:/usr/lib/x86_64-linux-gnu:$FAKE_PATH"
+          export LD_LIBRARY_PATH="$INITIAL_LD_LIBRARY_PATH"
+          module load "EESSI/${{matrix.EESSI_VERSION}}"
+          # Check we have a sanitised LD_LIBRARY_PATH
+          [ "$LD_LIBRARY_PATH" = "$FAKE_PATH" ] || (echo "LD_LIBRARY_PATH is not $FAKE_PATH but $LD_LIBRARY_PATH" && exit 1)
+          # Make sure things are back as we expect afterwards
+          module purge
+          [ "$LD_LIBRARY_PATH" = "$INITIAL_LD_LIBRARY_PATH" ] || (echo "LD_LIBRARY_PATH is not $INITIAL_LD_LIBRARY_PATH but $LD_LIBRARY_PATH" && exit 1)
+
   check_PS1_update_eessi_module:
     runs-on: ubuntu-24.04
     strategy:

diff --git a/init/modules/EESSI/2023.06.lua b/init/modules/EESSI/2023.06.lua
@@ -233,6 +233,34 @@ if os.getenv("EESSI_MODULE_STICKY") then
     load_message = load_message .. " (requires '--force' option to unload or purge)"
 end
 
+-- Filter system paths from LD_LIBRARY_PATH
+-- Needs to be reversible so first make a copy
+append_path ("__EESSI_DEFAULT_HOST_LD_LIBRARY_PATH__", os.getenv("LD_LIBRARY_PATH") or "")
+local function remove_system_paths(var)
+    local paths = os.getenv(var)
+    local system_lib_patterns = {
+        "^/lib(64)?(/|$)",
+        "^/usr/lib(64)?(/|$)",
+        "^/usr/local/lib(64)?(/|$)",
+    }
+    if not paths then return end
+
+    for path in string.gmatch(paths, "([^:]+)") do
+        for _, pat in ipairs(system_lib_patterns) do
+            if path:match(pat) then
+                remove_path(var, path)
+                break
+            end
+        end
+    end
+end
+-- on unload the variable will no longer exist
+if mode() == "load" then
+    remove_system_paths("__EESSI_DEFAULT_HOST_LD_LIBRARY_PATH__")
+end
+-- now we can use pushenv to retain/restore the original value
+pushenv ("LD_LIBRARY_PATH", os.getenv("__EESSI_DEFAULT_HOST_LD_LIBRARY_PATH__") or "")
+
 -- set CURL_CA_BUNDLE on RHEL-based systems
 ca_bundle_file_rhel = "/etc/pki/tls/certs/ca-bundle.crt"
 if isFile(ca_bundle_file_rhel) then