diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index 085c7c35..fedc4ea0 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -693,6 +693,10 @@ in
     ];
     nvme-cli.sandbox.capabilities = [ "sys_rawio" ];
 
+    # contains only `oathtool`, which i only use for evaluating TOTP codes from CLI/stdin
+    oath-toolkit.sandbox.method = "bwrap";
+    oath-toolkit.sandbox.wrapperType = "wrappedDerivation";
+
     # settings (electron app)
     obsidian.persist.byStore.plaintext = [ ".config/obsidian" ];