diff --git a/systemd/wireproxy.service b/systemd/wireproxy.service
index 832f813..0ecc551 100644
--- a/systemd/wireproxy.service
+++ b/systemd/wireproxy.service
@@ -40,7 +40,7 @@ RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK
 RestrictNamespaces=true
 RestrictRealtime=true
 SystemCallArchitectures=native
-SystemCallFilter=@system-service
+SystemCallFilter=@system-service @sandbox
 
 [Install]
 WantedBy=multi-user.target