diff --git a/config/mise/config.toml b/config/mise/config.toml
index c9f8a70..6d01b20 100644
--- a/config/mise/config.toml
+++ b/config/mise/config.toml
@@ -12,6 +12,7 @@ copilot-cli = "latest"
 "github:danielmiessler/fabric" = "latest"
 "github:mrusme/reader" = "latest"
 "github:rimio-ai/rimz" = "latest"
+"github:sandboxec/sandboxec" = "latest"
 "github:ulyssa/iamb" = "latest"
 "github:zed-industries/codex-acp" = "latest"
 herdr = "latest"
diff --git a/config/sandboxec/pi.yaml b/config/sandboxec/pi.yaml
new file mode 100644
index 0000000..42384cd
--- /dev/null
+++ b/config/sandboxec/pi.yaml
@@ -0,0 +1,39 @@
+abi: 6
+ignore-if-missing: true
+unsafe-host-runtime: true
+# Pi stores configuration, extensions, skills, and sessions under ~/.pi/agent.
+# The current workspace is writable so agent edits remain confined to the repo
+# from which Pi is launched. Network access is limited to model/API HTTPS.
+fs:
+  - rwx:$HOME/.pi/agent/
+  - rwx:$HOME/.pi-lens/
+  - rwx:$HOME/.pi/context-mode/
+  - rw:$HOME/.pi/agent/settings.json
+  - r:$HOME/.pi/agent/AGENTS.md
+  - rx:$HOME/.local/share/mise/installs/npm-earendil-works-pi-coding-agent/
+  - rw:$PWD
+  - rw:/tmp
+  - r:/dev/random
+  - r:/dev/urandom
+  - r:/etc/hosts
+  - r:/etc/ld.so.cache
+  - r:/etc/localtime
+  - r:/etc/nsswitch.conf
+  - r:/etc/resolv.conf
+  - r:/etc/ssl/certs
+  - r:/etc/ssl/certs/ca-certificates.crt
+  - r:/etc/ssl/openssl.cnf
+  - r:/home/linuxbrew/.linuxbrew/etc/openssl@3/openssl.cnf
+  - r:/proc/
+  - r:/proc/meminfo
+  - r:/proc/self/cgroup
+  - r:/proc/self/groups
+  - r:/proc/self/maps
+  - r:/proc/stat
+  - r:/sys/devices/system/cpu/online
+  - r:/usr/lib/locale/locale-archive
+  - r:/usr/lib/ssl/openssl.cnf
+  - r:/usr/share/locale/locale.alias
+  - rw:/dev/null
+net:
+  - c:443
diff --git a/mise.toml b/mise.toml
index 635e6c4..9b82749 100644
--- a/mise.toml
+++ b/mise.toml
@@ -59,6 +59,7 @@ dotfiles.default_mode = "symlink-each"
 "~/.profile" = { source = "config/bash/profile", mode = "symlink" }
 "~/.bash_aliases" = { source = "config/bash/aliases", mode = "symlink" }
 "~/.config/zero" = "config/zero"
+"~/.sandboxec" = "config/sandboxec"
 
 "~/.local/share/fonts/" = { source = "fonts", mode = "copy" }