diff --git a/hosts/common/programs/ols.nix b/hosts/common/programs/ols.nix
index 01a65f7f..e397fda3 100644
--- a/hosts/common/programs/ols.nix
+++ b/hosts/common/programs/ols.nix
@@ -36,6 +36,9 @@
 
     secrets.".config/ols/ols.toml" = ../../../secrets/common/ols.toml.bin;
 
+    sandbox.method = "bwrap";
+    sandbox.net = "all";
+
     services.ols = {
       description = "ols: Offline Location Service";
       command = "ols 2>&1";  # XXX: it logs to stderr, and my s6 infrastructure apparently doesn't handle that