diff --git a/hosts/common/programs/libreoffice.nix b/hosts/common/programs/libreoffice.nix
index c42f95ade..77e0ff20e 100644
--- a/hosts/common/programs/libreoffice.nix
+++ b/hosts/common/programs/libreoffice.nix
@@ -6,6 +6,16 @@
     # packageUnwrapped = pkgs.libreoffice-bin;
     # packageUnwrapped = pkgs.libreoffice-still;
     packageUnwrapped = pkgs.libreoffice-fresh;
+    sandbox.method = "bwrap";
+    sandbox.extraConfig = [
+      "--sane-sandbox-autodetect"
+    ];
+    sandbox.extraHomePaths = [
+      # allow a spot to save files.
+      # with bwrap sandboxing, saving to e.g. ~/ succeeds but the data is inaccessible outside the sandbox,
+      # easy to shoot yourself in the foot!
+      "tmp"
+    ];
 
     slowToBuild = true;