diff --git a/CLAUDE.md b/CLAUDE.md
index a8f8a0d..1d38410 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -35,6 +35,11 @@ Source layout (all under `src/`):
 - `bwrap.{h,cpp}` — `detect_bwrap_unshare_args()` probes the kernel (via a forked
   `unshare(2)` per namespace type) for which `--unshare-xxx` flags `bwrap` can actually
   use; `build_bwrap_args()`/`run_bwrap()` assemble and run the sandboxed command.
+  `build_bwrap_args()` deliberately drops `--unshare-net` from what's actually passed
+  to `bwrap` even when the kernel supports it — without any network setup (e.g.
+  `slirp4netns`), unsharing it just leaves the sandbox with no network at all. Re-add
+  once network isolation is implemented; `detect_bwrap_unshare_args()` itself still
+  probes/reports it (e.g. via `-t/--test`), since that's kernel capability, not policy.
   Never requests `--unshare-user` when running as root: root doesn't need a fresh
   user namespace for privilege, and bwrap's own single-mapping uid/gid setup for one
   triggers the kernel's unprivileged-userns setgroups() restriction, which showed up
diff --git a/src/bwrap.cpp b/src/bwrap.cpp
index aba125d..9be937a 100644
--- a/src/bwrap.cpp
+++ b/src/bwrap.cpp
@@ -159,6 +159,14 @@ std::vector<std::string> build_bwrap_args(const std::string& root,
     auto unshare_args = detect_bwrap_unshare_args();
     bool has_pid_ns = false;
     for (const auto& arg : unshare_args) {
+        // Not requested yet: without any network setup (slirp4netns or similar),
+        // unsharing it just leaves the sandbox with no network at all. Re-add once
+        // network isolation is implemented. (detect_bwrap_unshare_args() still
+        // probes/reports it, e.g. for -t/--test, since that's kernel capability, not
+        // policy.)
+        if (arg == "--unshare-net") {
+            continue;
+        }
         args.push_back(arg);
         if (arg == "--unshare-pid") {
             has_pid_ns = true;