diff --git a/.workmux.yaml b/.workmux.yaml
index 233d509b55..0b7d1707bc 100644
--- a/.workmux.yaml
+++ b/.workmux.yaml
@@ -45,3 +45,4 @@ files:
 sandbox:
   enabled: false
   toolchain: off
+  host_commands: ["cargo", "npm", "npx", "node", "git"]
diff --git a/dev-dashboard/backend/src/workmux.ts b/dev-dashboard/backend/src/workmux.ts
index 0515d9a1a4..97f207e4b8 100644
--- a/dev-dashboard/backend/src/workmux.ts
+++ b/dev-dashboard/backend/src/workmux.ts
@@ -95,6 +95,11 @@ export async function addWorktree(
     args.push("-C"); // --no-pane-cmds
   }
 
+  // Enable sandbox for yolo profile (safe to skip permissions inside container)
+  if (profile === "agent-yolo") {
+    args.push("-S"); // --sandbox
+  }
+
   if (opts?.prompt) args.push("-p", opts.prompt);
   args.push(branch);