diff --git a/README.md b/README.md
index 86c0db3e..2f546a11 100644
--- a/README.md
+++ b/README.md
@@ -608,6 +608,7 @@ A version from before v3.0.0 has no worker: `systemctl disable --now webvirt-wor
 - With the bundled nginx config, browsers revalidate static files on each load (304 when unchanged), so an update or a theme change shows without a hard reload. Files cached before this update can stay until a hard reload (Ctrl+F5) of each affected page, or until the site's browser cache is cleared once; an external caching proxy may need a purge.
 - External snapshots use libvirt's snapshot API and need libvirt 9.9 or newer on the compute hosts. They work on UEFI VMs and running, paused or shut-off VMs, can save memory too or, on a running VM with a connected QEMU guest agent, freeze the guest's file systems (the default there), and a revert keeps disks added later (it detaches them). A snapshot is refused when a storage pool with the VM's disks has less free space than a share of those disks (10%, at least 1 GiB; both on the Settings page) plus, for the pool of the memory file, the VM's memory; this is checked before the snapshot only, nothing is reserved. A VM's snapshots form one chain: after a revert, delete the newer snapshots before taking another. Snapshot names no longer get an `s1.` prefix; existing ones keep theirs and can still be reverted and deleted, except that a snapshot an older version took of a UEFI VM can only be deleted. On NFS, libvirt removes merged snapshot files as the qemu user, who needs write access to the image directory; files it could not remove are named in a warning after the delete or revert. Deleting a VM with its data removes its snapshot files too, except a template it grew from and files another VM uses.
 - A storage volume a VM still needs (a disk, a backing file or a snapshot's file) is no longer deleted from the storage page or the API; the delete is refused with the reason. Only VMs on the same compute are checked.
+- The `webvirt-novncd` and `webvirt-socketiod` units run sandboxed (read-only system directories, no home directories under `/home`, no new privileges); the units installed in step 4 bring this.
 - The VNC console connects to `/novncd/` on the panel's own address, scheme and port, through nginx: it works on HTTPS, behind another proxy and on any published port without settings. `WS_PUBLIC_PORT`, `WS_PUBLIC_HOST`, `WS_PUBLIC_PATH` and `WS_CERT` are gone; remove them from `docker-compose.override.yml`, `/etc/default/webvirtcloud` or a kept `settings.py`, set `WS_HOST = "127.0.0.1"` in a kept `settings.py`, and close port 6080 in the firewall.
 - The serial console works (off by default, see [Serial console](#serial-console)); `SOCKETIO_PUBLIC_HOST`/`_PORT`/`_PATH` are gone, the page uses the panel's own address.
 - Long operations run as jobs in a worker process (`manage.py run_worker`); follow them on the VM page and on the Jobs page.
diff --git a/conf/systemd/webvirt-novncd.service b/conf/systemd/webvirt-novncd.service
index f9c3d075..7f4bd4a7 100644
--- a/conf/systemd/webvirt-novncd.service
+++ b/conf/systemd/webvirt-novncd.service
@@ -11,6 +11,18 @@ EnvironmentFile=-/etc/default/webvirtcloud
 ExecStart=/srv/webvirtcloud/venv/bin/python3 /srv/webvirtcloud/console/novncd
 Restart=on-failure
 RestartSec=10
+# Sandbox: what the console daemons need (TCP and Unix sockets, ssh,
+# writes under /srv and the user's ~/.ssh) and no more. No private /tmp:
+# a VM's VNC Unix socket may be there.
+NoNewPrivileges=yes
+ProtectSystem=full
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictSUIDSGID=yes
+LockPersonality=yes
 
 [Install]
 WantedBy=multi-user.target
diff --git a/conf/systemd/webvirt-socketiod.service b/conf/systemd/webvirt-socketiod.service
index 6d28d0c6..343a3cd6 100644
--- a/conf/systemd/webvirt-socketiod.service
+++ b/conf/systemd/webvirt-socketiod.service
@@ -13,6 +13,18 @@ ExecStart=/srv/webvirtcloud/venv/bin/python3 /srv/webvirtcloud/console/socketiod
 KillMode=mixed
 Restart=on-failure
 RestartSec=10
+# Sandbox: what the console daemons need (a pty and its worker, TCP and
+# Unix sockets, ssh, writes under /srv and the user's ~/.ssh) and no more
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=full
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictSUIDSGID=yes
+LockPersonality=yes
 
 [Install]
 WantedBy=multi-user.target