diff --git a/.workmux.yaml b/.workmux.yaml
index c6cc49ae40..2e78c524f9 100644
--- a/.workmux.yaml
+++ b/.workmux.yaml
@@ -53,4 +53,6 @@ files:
 sandbox:
   enabled: false
   toolchain: off
-  # image and host_commands configured in global ~/.config/workmux/config.yaml
+  # image, host_commands, and extra_mounts configured in global
+  # ~/.config/workmux/config.yaml — see README_WORKMUX_DEV.md for required
+  # extra_mounts (windmill-ee-private access in sandbox)
diff --git a/README_WORKMUX_DEV.md b/README_WORKMUX_DEV.md
index dc2f287bee..e4057d2233 100644
--- a/README_WORKMUX_DEV.md
+++ b/README_WORKMUX_DEV.md
@@ -172,6 +172,25 @@ The setup is defined in `.workmux.yaml` at the repo root. Key sections:
 - **`files.copy`**: Copies `backend/.env` and `scripts/` into each worktree
 - **`files.symlink`**: Symlinks `node_modules` and `.svelte-kit` to avoid reinstalling per worktree
 
+## Enterprise (EE) Code Access
+
+The enterprise source code lives in the `windmill-ee-private` repository (sibling to this repo). When you create a worktree, `scripts/worktree-env` automatically creates a matching EE worktree on the same branch and configures Claude Code's `additionalDirectories` to grant access.
+
+### Sandbox setup
+
+When using sandbox mode, the container needs explicit mounts to access the EE repo. Add the following to your global workmux config (`~/.config/workmux/config.yaml`):
+
+```yaml
+sandbox:
+  extra_mounts:
+    - host_path: ~/windmill-ee-private
+      writable: true
+    - host_path: ~/windmill-ee-private__worktrees
+      writable: true
+```
+
+This mounts both the main EE repo (used by the main worktree) and the EE worktrees directory (used by feature worktrees) into every sandbox container.
+
 ## Login
 
 Default credentials: `admin@windmill.dev` / `changeme`