diff --git a/hosts/common/programs/komikku.nix b/hosts/common/programs/komikku.nix
index b10fc6e80..22a3cd9ec 100644
--- a/hosts/common/programs/komikku.nix
+++ b/hosts/common/programs/komikku.nix
@@ -3,8 +3,12 @@
   sane.programs.komikku = {
     sandbox.method = "bwrap";  # TODO:sandbox untested
     sandbox.wrapperType = "wrappedDerivation";
+    sandbox.whitelistDri = true;  #< required
     secrets.".local/share/komikku/keyrings/plaintext.keyring" = ../../../secrets/common/komikku_accounts.json.bin;
     # downloads end up here, and without the toplevel database komikku doesn't know they exist.
-    persist.byStore.plaintext = [ ".local/share/komikku" ];
+    persist.byStore.plaintext = [
+      # also writes to ~/.cache/komikku
+      ".local/share/komikku"
+    ];
   };
 }