diff --git a/docs/site/content/docs/install.mdx b/docs/site/content/docs/install.mdx
index b07d7af7fb0..71e60e3a610 100644
--- a/docs/site/content/docs/install.mdx
+++ b/docs/site/content/docs/install.mdx
@@ -108,7 +108,7 @@ The AppImage has a stable download link per architecture — [`orca-linux.AppIma
 **The `.deb` and `.rpm` do not self-update.** Orca still notices the new version and downloads the package, then gives you a **Copy Install Command** button. Copy it rather than retyping it: Orca resolves every program to an absolute path in a trusted system directory and single-quotes the package path, so what you paste looks like this:
 
 ```
-/usr/bin/sudo /usr/bin/apt install -- '/home/you/.cache/orca-updater/pending/orca-ide_1.4.194_amd64.deb'
+/usr/bin/sudo /usr/bin/apt -o Binary::file::APT::Sandbox::User=root install -- '/home/you/.cache/orca-updater/pending/orca-ide_1.4.194_amd64.deb'
 ```
 
 Which package manager appears depends on what your system actually has: `apt`, else `dpkg -i`, for a `.deb`; `zypper`, `dnf`, `yum`, then `rpm -Uvh` for an `.rpm`. The download directory follows `XDG_CACHE_HOME` when that is set and falls back to `~/.cache` when it is not.
diff --git a/src/main/linux-package-install-command.test.ts b/src/main/linux-package-install-command.test.ts
index 196db14b4c7..31787531745 100644
--- a/src/main/linux-package-install-command.test.ts
+++ b/src/main/linux-package-install-command.test.ts
@@ -168,7 +168,8 @@ describe('buildLinuxPackageInstallCommand', () => {
     const { buildLinuxPackageInstallCommand } = await loadCommandModule()
     expect(buildLinuxPackageInstallCommand('deb', '/tmp/orca.deb')).toEqual({
       ok: true,
-      command: "/usr/bin/sudo /usr/bin/apt install -- '/tmp/orca.deb'"
+      command:
+        "/usr/bin/sudo /usr/bin/apt -o Binary::file::APT::Sandbox::User=root install -- '/tmp/orca.deb'"
     })
   })
 
@@ -246,7 +247,7 @@ describe('buildLinuxPackageInstallCommand', () => {
     const { buildLinuxPackageInstallCommand } = await loadCommandModule()
     expect(buildLinuxPackageInstallCommand('deb', "/tmp/a b'; id #.deb")).toEqual({
       ok: true,
-      command: `/usr/bin/sudo /usr/bin/apt install -- '/tmp/a b'"'"'; id #.deb'`
+      command: `/usr/bin/sudo /usr/bin/apt -o Binary::file::APT::Sandbox::User=root install -- '/tmp/a b'"'"'; id #.deb'`
     })
   })
 })
diff --git a/src/main/linux-package-install-command.ts b/src/main/linux-package-install-command.ts
index 1f7b2056790..ad9238c62f6 100644
--- a/src/main/linux-package-install-command.ts
+++ b/src/main/linux-package-install-command.ts
@@ -7,7 +7,8 @@ import type { LinuxRootPackageType } from '../shared/update-status-types'
 const TRUSTED_EXECUTABLE_DIRECTORIES = ['/usr/bin', '/bin', '/usr/sbin', '/sbin']
 
 const DEB_PACKAGE_MANAGERS: { name: string; args: string[] }[] = [
-  { name: 'apt', args: ['install', '--'] },
+  // Preset apt's own root fallback for file: reads (_apt can't read ~/.cache); network methods stay sandboxed.
+  { name: 'apt', args: ['-o', 'Binary::file::APT::Sandbox::User=root', 'install', '--'] },
   { name: 'dpkg', args: ['-i', '--'] }
 ]