diff --git a/hosts/common/programs/ntfy-sh.nix b/hosts/common/programs/ntfy-sh.nix
index a52cc9ed..2a44a40f 100644
--- a/hosts/common/programs/ntfy-sh.nix
+++ b/hosts/common/programs/ntfy-sh.nix
@@ -20,6 +20,10 @@ in
       };
     };
 
+    sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
+    sandbox.net = "clearnet";
+
     secrets.".config/ntfy-sh/topic" = ../../../secrets/common/ntfy-sh-topic.bin;
 
     services.ntfy-sub = {