diff --git a/packages/kilo-sandbox/src/bubblewrap.ts b/packages/kilo-sandbox/src/bubblewrap.ts
index 69966f7d9c..5df35b1985 100644
--- a/packages/kilo-sandbox/src/bubblewrap.ts
+++ b/packages/kilo-sandbox/src/bubblewrap.ts
@@ -114,9 +114,6 @@ export function generate(
   executable: string,
   mounts = process.platform === "linux" ? mountpoints() : [],
 ): Launch {
-  if (profile.network.mode !== "allow" || profile.network.allowedHosts.length > 0) {
-    throw new Error("Linux process sandbox network restrictions are not supported")
-  }
   const allow = writable(profile)
   validate(allow, executable, mounts)
   const args = [
diff --git a/packages/kilo-sandbox/test/backend.test.ts b/packages/kilo-sandbox/test/backend.test.ts
index fad44d1d8d..9f0e36e4b4 100644
--- a/packages/kilo-sandbox/test/backend.test.ts
+++ b/packages/kilo-sandbox/test/backend.test.ts
@@ -75,12 +75,6 @@ describe("sandbox launch preparation", () => {
     expect(args.args.slice(-4)).toEqual(["--", "/bin/sh", "-c", "printf '%s' 'hello world'"])
   })
 
-  test("fails Linux network restrictions closed without changing the network namespace", () => {
-    expect(() => generateBubblewrap(makeProfile("deny"), launch, "/opt/kilo/bwrap", [])).toThrow(
-      "Linux process sandbox network restrictions are not supported",
-    )
-  })
-
   test("layers Linux writable roots before protected git metadata without changing the network namespace", () => {
     const root = mkdtempSync(path.join(os.tmpdir(), "kilo-bubblewrap-policy-"))
     const git = path.join(root, ".git")
@@ -173,12 +167,12 @@ describe("sandbox launch preparation", () => {
   })
 
   test("merges profile environment values and applies exact deny names", async () => {
-    const result = await Effect.runPromise(Effect.scoped(run(makeProfile(), prepare(launch))))
+    const result = await Effect.runPromise(Effect.scoped(run(makeProfile("allow"), prepare(launch))))
     expect(result.environment?.KEEP).toBe("profile")
     expect(result.environment?.DROP).toBeUndefined()
     expect(result.environment?.RESET).toBeUndefined()
-    expect(result.environment?.HTTPS_PROXY).toBeUndefined()
-    expect(result.environment?.no_proxy).toBeUndefined()
+    expect(result.environment?.HTTPS_PROXY).toBe("http://127.0.0.1:9000")
+    expect(result.environment?.no_proxy).toBe("*")
     expect(result.environment?.PATH).toBeUndefined()
   })
 
diff --git a/packages/kilo-sandbox/test/filesystem.test.ts b/packages/kilo-sandbox/test/filesystem.test.ts
index 8b9e5ac4ac..1d22fe8b3c 100644
--- a/packages/kilo-sandbox/test/filesystem.test.ts
+++ b/packages/kilo-sandbox/test/filesystem.test.ts
@@ -321,18 +321,21 @@ describe("sandbox FileSystem", () => {
     },
   )
 
-  test.skipIf(process.platform === "darwin")("fails closed when the OS backend is unavailable", async () => {
-    await execute(
-      run(
-        makeProfile(allowed),
-        Effect.gen(function* () {
-          const fs = yield* FileSystem.FileSystem
-          const denied = yield* fs.writeFileString(path.join(allowed, "blocked.txt"), "blocked").pipe(Effect.flip)
-          expect(denied.reason._tag).toBe("PermissionDenied")
-        }),
-      ),
-    )
-  })
+  test.skipIf(process.platform === "darwin" || process.platform === "linux")(
+    "fails closed when the OS backend is unavailable",
+    async () => {
+      await execute(
+        run(
+          makeProfile(allowed),
+          Effect.gen(function* () {
+            const fs = yield* FileSystem.FileSystem
+            const denied = yield* fs.writeFileString(path.join(allowed, "blocked.txt"), "blocked").pipe(Effect.flip)
+            expect(denied.reason._tag).toBe("PermissionDenied")
+          }),
+        ),
+      )
+    },
+  )
 
   test("passes through mutations when no profile is active", async () => {
     await execute(