diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index e381e2a1..0c8716e6 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -394,6 +394,8 @@ in
 
     superTux.persist.byStore.plaintext = [ ".local/share/supertux2" ];
 
+    swaylock.sandbox.enable = false;  #< neither landlock nor bwrap works. pam_authenticate failed: invalid credentials. does it rely on SUID?
+
     tdesktop.persist.byStore.private = [ ".local/share/TelegramDesktop" ];
 
     tokodon.persist.byStore.private = [ ".cache/KDE/tokodon" ];