diff --git a/hosts/common/programs/satellite.nix b/hosts/common/programs/satellite.nix
index e9a81f086..cb71d8c0f 100644
--- a/hosts/common/programs/satellite.nix
+++ b/hosts/common/programs/satellite.nix
@@ -49,5 +49,11 @@
 #
 { ... }:
 {
-  sane.programs.satellite = {};
+  sane.programs.satellite = {
+    sandbox.method = "bwrap";
+    sandbox.whitelistDbus = [
+      "system"  #< reads NMEA data via ModemManager
+    ];
+    sandbox.whitelistWayland = true;
+  };
 }