diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index 6e068a1dc..8a7a74c0d 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -400,6 +400,12 @@ in
 
     backblaze-b2 = {};
 
+    bitcoind.sandbox.method = "bwrap";
+    bitcoind.sandbox.extraHomePaths = [
+      ".config/bitcoin/bitcoin.conf"
+    ];
+    bitcoind.sandbox.net = "all";  # actually needs only localhost
+
     blanket.buildCost = 1;
     blanket.sandbox.method = "bwrap";
     blanket.sandbox.whitelistAudio = true;