diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index 2ebf33ee9..e54669ace 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -1050,10 +1050,10 @@ in
       requests
       unidecode
     ]);
-    python3-repl.sandbox.method = "bwrap";
+    python3-repl.sandbox.method = "bunpen";
     python3-repl.sandbox.net = "clearnet";
     python3-repl.sandbox.extraHomePaths = [
-      "/"
+      "/"  #< this is 'safe' because with don't expose .persist/private, so no .ssh/id_ed25519
       ".persist/plaintext"
     ];