diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index 898b3f9ab..5eb7b70fd 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -444,6 +444,9 @@ in
 
     btrfs-progs.sandbox.method = "bunpen";  #< bwrap, landlock: both work
     btrfs-progs.sandbox.autodetectCliPaths = "existing";  # e.g. `btrfs filesystem df /my/fs`
+    btrfs-progs.sandbox.extraPaths = [
+      "/dev/btrfs-control"
+    ];
 
     "cacert.unbundled".sandbox.enable = false;  #< data only