diff --git a/hosts/common/programs/brave.nix b/hosts/common/programs/brave.nix
index fad2fca1..d00b0b37 100644
--- a/hosts/common/programs/brave.nix
+++ b/hosts/common/programs/brave.nix
@@ -8,6 +8,9 @@
       "dev"  # for developing anything web-related
       "tmp"
     ];
+    sandbox.extraPaths = [
+      "/tmp"  # needed particularly if run from `sane-vpn do`
+    ];
     sandbox.whitelistAudio = true;
     sandbox.whitelistDri = true;
     sandbox.whitelistWayland = true;