diff --git a/hosts/common/programs/rofi/config.rasi b/hosts/common/programs/rofi/config.rasi
index 64c2f6a7..1b2a7509 100644
--- a/hosts/common/programs/rofi/config.rasi
+++ b/hosts/common/programs/rofi/config.rasi
@@ -16,6 +16,7 @@ configuration {
     directory: "/home";
     /* display-name: text to prepend in combi mode */
     display-name: "/";
+    command: "xdg-open";
   }
   drun {
     display-name: " ";
@@ -27,6 +28,9 @@ configuration {
   /* combi-display-format: "{text}"; */
   combi-display-format: "{mode}{text}";
 
+  /* launch applications via xdg-desktop-portal */
+  run-command: "gdbus call --session --timeout 10 --dest org.freedesktop.portal.Desktop --object-path /org/freedesktop/portal/desktop --method org.freedesktop.portal.DynamicLauncher.Launch {app_id}.desktop {}";
+
   drun-use-desktop-cache: true;
 }
 
diff --git a/hosts/common/programs/rofi/default.nix b/hosts/common/programs/rofi/default.nix
index 642b0fad..2b869ab5 100644
--- a/hosts/common/programs/rofi/default.nix
+++ b/hosts/common/programs/rofi/default.nix
@@ -49,6 +49,26 @@
       });
     };
 
+    suggestedPrograms = [
+      "xdg-utils"
+      "gdbus"
+    ];
+
+    sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
+    sandbox.whitelistDbus = [ "user" ];  #< to launch apps via the portal
+    sandbox.whitelistWayland = true;
+    sandbox.extraHomePaths = [
+      ".local/share/applications"  #< to locate .desktop files
+      "Music"
+      "Pictures"
+      "Pictures/servo-macros"
+      "Videos"
+      "Videos/servo"
+      "knowledge"
+      "tmp"
+    ];
+
     fs.".config/rofi/config.rasi".symlink.target = ./config.rasi;
     # redirect its default drun cache location
     fs.".cache/rofi3.druncache".symlink.target = "rofi/rofi3.druncache";