diff --git a/hosts/common/programs/networkmanager_dmenu/default.nix b/hosts/common/programs/networkmanager_dmenu/default.nix
index b2cb877df..e2e472774 100644
--- a/hosts/common/programs/networkmanager_dmenu/default.nix
+++ b/hosts/common/programs/networkmanager_dmenu/default.nix
@@ -2,6 +2,16 @@
 { ... }:
 {
   sane.programs.networkmanager_dmenu = {
+    sandbox.method = "bwrap";
+    sandbox.isolatePids = false;  #< so it can know that NetworkManager really is running... (?)
+    sandbox.whitelistDbus = [
+      "system"
+    ];
+    sandbox.whitelistWayland = true;
+    sandbox.extraHomePaths = [
+      ".cache/rofi"
+      ".config/rofi"
+    ];
     suggestedPrograms = [
       "pidof"
     ];