diff --git a/modules/nix.nix b/modules/nix.nix
index 1a9a482..76d6c52 100644
--- a/modules/nix.nix
+++ b/modules/nix.nix
@@ -19,11 +19,13 @@ in {
 
   nix.settings = {
     experimental-features = "nix-command flakes";
-    build-users-group = "nixbld";
-    trusted-users = ["ryanccn"];
     auto-optimise-store = true;
     extra-platforms = ["x86_64-darwin" "aarch64-darwin"];
 
+    sandbox = true;
+    build-users-group = "nixbld";
+    trusted-users = ["ryanccn"];
+
     extra-substituters = [
       "https://nix-community.cachix.org"
       "https://crane.cachix.org"