diff --git a/hosts/common/programs/nix-index.nix b/hosts/common/programs/nix-index.nix
index aa942213..19a3e8ec 100644
--- a/hosts/common/programs/nix-index.nix
+++ b/hosts/common/programs/nix-index.nix
@@ -2,6 +2,13 @@
 {
   # provides `nix-locate`, backed by the manually run `nix-index`
   sane.programs.nix-index = {
+    sandbox.method = "bwrap";
+    sandbox.wrapperType = "wrappedDerivation";
+    sandbox.net = "clearnet";
+    sandbox.extraPaths = [
+      "/nix"
+    ];
+
     persist.byStore.plaintext = [ ".cache/nix-index" ];
   };
 }