diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index a1600d2d..694c846a 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -447,7 +447,8 @@ in
     superTux.sandbox.whitelistWayland = true;
     superTux.persist.byStore.plaintext = [ ".local/share/supertux2" ];
 
-    swaylock.sandbox.enable = false;  #< neither landlock nor bwrap works. pam_authenticate failed: invalid credentials. does it rely on SUID?
+    swaylock.sandbox.method = "capshonly";  #< neither landlock nor bwrap works. pam_authenticate failed: invalid credentials. does it rely on SUID?
+    swaylock.sandbox.wrapperType = "wrappedDerivation";
 
     tdesktop.persist.byStore.private = [ ".local/share/TelegramDesktop" ];