diff --git a/hosts/common/programs/sane-input-handler/default.nix b/hosts/common/programs/sane-input-handler/default.nix
index 946110c9a..730dbb26c 100644
--- a/hosts/common/programs/sane-input-handler/default.nix
+++ b/hosts/common/programs/sane-input-handler/default.nix
@@ -99,6 +99,7 @@ in
     ];
     sandbox.whitelistAudio = true;
     sandbox.whitelistDbus = [ "user" ];  #< to launch applications
+    sandbox.whitelistSystemctl = true;  #< to restart bonsaid on failure
     sandbox.extraRuntimePaths = [ "sway" ];
     sandbox.keepPidsAndProc = true;  #< for toggling the keyboard
   };
diff --git a/hosts/common/programs/sane-input-handler/sane-input-handler b/hosts/common/programs/sane-input-handler/sane-input-handler
index 40243df03..26c5e30b9 100755
--- a/hosts/common/programs/sane-input-handler/sane-input-handler
+++ b/hosts/common/programs/sane-input-handler/sane-input-handler
@@ -205,6 +205,10 @@ dispatchOff() {
       # power once => unlock
       handleWith allOn
       ;;
+    "power_tap_1_hold")
+      # power tap->hold: escape hatch for when bonsaid locks up
+      handleWith systemctl restart bonsaid
+      ;;
     volup_hold*)
       handleWith playerctl position 30+
       ;;