diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index c2872faf..c8f39235 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -242,6 +242,10 @@ in
       "/sys/devices"
     ];
 
+    bridge-utils.sandbox.method = "landlock";  #< has to be in the same net namespace, at least.
+    bridge-utils.sandbox.wrapperType = "wrappedDerivation";
+    bridge-utils.sandbox.net = "all";
+
     brightnessctl.sandbox.method = "landlock";  # also bwrap, but landlock is more responsive
     brightnessctl.sandbox.wrapperType = "wrappedDerivation";
     brightnessctl.sandbox.extraPaths = [