diff --git a/Cargo.lock b/Cargo.lock
index 2f8a7f7..d8f9d59 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "dosh"
-version = "0.1.11"
+version = "0.1.12"
 dependencies = [
  "anyhow",
  "base64",
diff --git a/Cargo.toml b/Cargo.toml
index 29ce1d4..cae6fd2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "dosh"
-version = "0.1.11"
+version = "0.1.12"
 edition = "2024"
 license = "MIT"
 
diff --git a/install.sh b/install.sh
index c198c7c..b9ff889 100755
--- a/install.sh
+++ b/install.sh
@@ -434,7 +434,7 @@ PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=read-only
 ReadWritePaths=$config_dir $data_dir
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
 RestrictRealtime=true
 LockPersonality=true
 MemoryDenyWriteExecute=true
diff --git a/packaging/systemd/dosh-server.service b/packaging/systemd/dosh-server.service
index 5a1c660..3f2ced1 100644
--- a/packaging/systemd/dosh-server.service
+++ b/packaging/systemd/dosh-server.service
@@ -14,7 +14,7 @@ PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=read-only
 ReadWritePaths=%h/.config/dosh %h/.local/share/dosh
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
 RestrictRealtime=true
 LockPersonality=true
 MemoryDenyWriteExecute=true
diff --git a/tests/release_scripts.rs b/tests/release_scripts.rs
index dda7c40..2785bb4 100644
--- a/tests/release_scripts.rs
+++ b/tests/release_scripts.rs
@@ -18,3 +18,15 @@ fn release_scripts_skip_stale_artifacts_when_auto_discovering() {
     assert!(publish.contains("skipping stale artifact"));
     assert!(publish.contains("actual=\"$(artifact_version \"$artifact\" || true)\""));
 }
+
+#[test]
+fn systemd_sandbox_allows_netlink_for_terminal_tools() {
+    let service = include_str!("../packaging/systemd/dosh-server.service");
+    let install = include_str!("../install.sh");
+    for raw in [service, install] {
+        assert!(
+            raw.contains("RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK"),
+            "dosh sessions must allow AF_NETLINK so tools like btop can enumerate network interfaces"
+        );
+    }
+}