diff --git a/hosts/common/programs/calls.nix b/hosts/common/programs/calls.nix
index ca5ac8c2..e55b24be 100644
--- a/hosts/common/programs/calls.nix
+++ b/hosts/common/programs/calls.nix
@@ -41,6 +41,12 @@ in
       ];
     });
 
+    sandbox.method = "bwrap";
+    sandbox.net = "clearnet";
+    sandbox.whitelistAudio = true;
+    sandbox.whitelistDbus = [ "user" ];  # necessary for secrets, at the minimum
+    sandbox.whitelistWayland = true;
+
     persist.byStore.private = [
       # ".cache/folks"      # contact avatars?
       # ".config/calls"