diff --git a/hosts/common/programs/mercurial.nix b/hosts/common/programs/mercurial.nix
index 3d14e83da..306b50e41 100644
--- a/hosts/common/programs/mercurial.nix
+++ b/hosts/common/programs/mercurial.nix
@@ -3,6 +3,7 @@
   sane.programs.mercurial = {
     sandbox.net = "clearnet";
     sandbox.whitelistPwd = true;
+    sandbox.whitelistSsh = true;
     sandbox.extraHomePaths = [
       # even with `whitelistPwd`, hg has to crawl *up* the path -- which isn't necessarily in the sandbox -- to locate the repo root.
       "dev"