diff --git a/hosts/common/programs/sway/default.nix b/hosts/common/programs/sway/default.nix
index 65194d79..a7ef500b 100644
--- a/hosts/common/programs/sway/default.nix
+++ b/hosts/common/programs/sway/default.nix
@@ -182,7 +182,7 @@ in
     ];
 
     sandbox.method = "bwrap";
-    sandbox.wrapperType = "inplace";
+    sandbox.wrapperType = "inplace";  #< `sway` is a wrapper around `sway-unwrapped`, so cheap to sandbox
     sandbox.net = "all";  # TODO: shouldn't be needed! but without this, mouse/kb hotplug doesn't work.
     sandbox.whitelistAudio = true;  # it runs playerctl directly
     sandbox.whitelistDbus = [ "system" "user" ];  # to e.g. launch apps