diff --git a/hosts/common/programs/wvkbd.nix b/hosts/common/programs/wvkbd.nix
index 1bad9e09a..8927b171a 100644
--- a/hosts/common/programs/wvkbd.nix
+++ b/hosts/common/programs/wvkbd.nix
@@ -4,6 +4,9 @@ let
 in
 {
   sane.programs.wvkbd = {
+    sandbox.method = "bwrap";
+    sandbox.whitelistWayland = true;
+
     services.wvkbd = {
       description = "wvkbd: wayland virtual keyboard";
       after = [ "graphical-session.target" ];