diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index df3b96c63..737f9001f 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -452,11 +452,6 @@ in
 
     bash-language-server.sandbox.whitelistPwd = true;
 
-    blanket.buildCost = 1;
-    blanket.sandbox.whitelistAudio = true;
-    # blanket.sandbox.whitelistDbus.user = true;  #< TODO: reduce  # TODO: untested
-    blanket.sandbox.whitelistWayland = true;
-
     bridge-utils.sandbox.net = "all";
 
     "cacert.unbundled".sandbox.enable = false;  #< data only
diff --git a/hosts/common/programs/blanket.nix b/hosts/common/programs/blanket.nix
new file mode 100644
index 000000000..1c4826975
--- /dev/null
+++ b/hosts/common/programs/blanket.nix
@@ -0,0 +1,13 @@
+{ ... }:
+{
+  sane.programs.blanket = {
+    # com.rafaelmardojai.Blanket
+    buildCost = 1;
+    sandbox.whitelistAudio = true;
+    sandbox.whitelistDbus.user.own = [
+      "com.rafaelmardojai.Blanket"
+      "org.mpris.MediaPlayer2.Blanket"
+    ];
+    sandbox.whitelistWayland = true;
+  };
+}
diff --git a/hosts/common/programs/default.nix b/hosts/common/programs/default.nix
index bc2b7fa98..89969c5ba 100644
--- a/hosts/common/programs/default.nix
+++ b/hosts/common/programs/default.nix
@@ -13,6 +13,7 @@
     ./avahi.nix
     ./bemenu.nix
     ./bitcoin-cli.nix
+    ./blanket.nix
     ./blueberry.nix
     ./blueman.nix
     ./bonsai.nix