diff --git a/hosts/andromache/default.nix b/hosts/andromache/default.nix
index b38dde5..0eb3dab 100644
--- a/hosts/andromache/default.nix
+++ b/hosts/andromache/default.nix
@@ -68,6 +68,7 @@ in
       "/data"
     ];
   };
+  sandboxing.enable = true;
   secrets = {
     enable = true;
     nixSigningKey.enable = true;
diff --git a/hosts/astyanax/default.nix b/hosts/astyanax/default.nix
index 76d8858..271b225 100644
--- a/hosts/astyanax/default.nix
+++ b/hosts/astyanax/default.nix
@@ -52,6 +52,7 @@ in
     };
   };
   networking.enable = true;
+  sandboxing.enable = true;
   secrets.enable = true;
   ssh.enable = true;
   storage.enable = true;
diff --git a/modules/sandboxing/default.nix b/modules/sandboxing/default.nix
new file mode 100644
index 0000000..4835cc2
--- /dev/null
+++ b/modules/sandboxing/default.nix
@@ -0,0 +1,17 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.sandboxing;
+in
+{
+  options.sandboxing.enable = lib.mkOption { default = false; };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.bubblewrap ];
+  };
+}