diff --git a/hosts/common/programs/tangram.nix b/hosts/common/programs/tangram.nix
index 759877b1e..e821af4be 100644
--- a/hosts/common/programs/tangram.nix
+++ b/hosts/common/programs/tangram.nix
@@ -29,6 +29,13 @@ in
 
     slowToBuild = true;  # only true for cross-compiled tangram
 
+    sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
+    sandbox.net = "clearnet";
+    sandbox.whitelistAudio = true;
+    sandbox.whitelistDri = true;
+    sandbox.whitelistWayland = true;
+
     persist.byStore.private = [
       ".cache/Tangram"
       ".local/share/Tangram"