diff --git a/hosts/common/programs/zsh/default.nix b/hosts/common/programs/zsh/default.nix
index fa1cd238..c7362dc0 100644
--- a/hosts/common/programs/zsh/default.nix
+++ b/hosts/common/programs/zsh/default.nix
@@ -53,6 +53,7 @@ in
   config = mkMerge [
     ({
       sane.programs.zsh = {
+        sandbox.enable = false;
         persist.byStore.private = [
           # we don't need to full zsh dir -- just the history file --
           # but zsh will sometimes backup the history file and symlinking just the file messes things up