diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index 3bbebfbc..a402cd5e 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -229,6 +229,9 @@ in
     cargo.persist.byStore.plaintext = [ ".cargo" ];
 
     # auth token, preferences
+    delfin.sandbox.method = "bwrap";
+    delfin.sandbox.wrapperType = "wrappedDerivation";
+    delfin.sandbox.whitelistDri = true;
     delfin.persist.byStore.private = [ ".config/delfin" ];
 
     # creds, but also 200 MB of node modules, etc