diff --git a/hosts/netty/openclaw-gateway.nix b/hosts/netty/openclaw-gateway.nix
index cfabdbf..94f9a0a 100644
--- a/hosts/netty/openclaw-gateway.nix
+++ b/hosts/netty/openclaw-gateway.nix
@@ -59,7 +59,7 @@ in
       };
       tools = {
         profile = "coding";
-        fs.workspaceOnly = false;
+        fs.workspaceOnly = true;
         loopDetection.enabled = true;
         deny = [ "sessions_send" "sessions_spawn" ];
       };