diff --git a/content/manuals/ai/sandboxes/configuration/environment-files.md b/content/manuals/ai/sandboxes/configuration/environment-files.md
index 5a5b32fefe5..bbed4268ce5 100644
--- a/content/manuals/ai/sandboxes/configuration/environment-files.md
+++ b/content/manuals/ai/sandboxes/configuration/environment-files.md
@@ -672,6 +672,7 @@ kits. Bindings take effect when the sandbox is created.
 | `profile`     | string          | None     | Governance profile name                               |
 | `skills`      | string          | Daemon default | Shared agent skills store access: `off`, `readonly`, or `readwrite` |
 | `display`     | boolean         | `false`  | Provision a display socket for graphical applications |
+| `fuse`        | boolean         | `sandbox.fuse` setting | Mount FUSE filesystems; local only |
 | `gpu`         | boolean         | `false`  | Pass the host GPU through to the sandbox               |
 | `usb`         | list of strings | None     | USB device selectors to pass through to the sandbox   |
 | `writableEnvFiles` | boolean     | `false`  | Let the sandbox write to shared environment files; local only |
@@ -687,6 +688,10 @@ store. Set it to `off` to omit the mount, `readonly` to mount the store read-onl
 or `readwrite` to let the sandbox modify shared skills. If omitted, it uses the
 daemon's default, which is `readonly` unless your organization overrides it.
 
+Set `fuse` to `false` to disable FUSE access for this sandbox. See the
+[`sandbox.fuse` setting](settings.md#sandboxfuse) for defaults and when changes
+take effect.
+
 ### `lifecycle`
 
 The `lifecycle` block declares commands that run on the host with your user
diff --git a/content/manuals/ai/sandboxes/configuration/settings.md b/content/manuals/ai/sandboxes/configuration/settings.md
index 6d57bd52564..1aa6d902b00 100644
--- a/content/manuals/ai/sandboxes/configuration/settings.md
+++ b/content/manuals/ai/sandboxes/configuration/settings.md
@@ -198,6 +198,24 @@ permissions, outside the sandbox. Leave the setting at `false` to require
 approval on every invocation, or use `--force` to approve only one
 invocation. See [environment lifecycle commands](environment-files.md#lifecycle).
 
+#### sandbox.fuse {.wrap-anywhere}
+
+{{< setting-metadata type="boolean" default="true" >}}
+
+Expose `/dev/fuse` and grant the `SYS_ADMIN` capability so processes can mount
+FUSE filesystems in local sandboxes. Set this to `false` to disable FUSE access
+for sandboxes you create:
+
+```console
+$ sbx settings set sandbox.fuse false
+```
+
+Changes apply only to newly created sandboxes. Existing sandboxes retain their
+FUSE configuration, including after restarts. To disable access for one sandbox,
+set [`sandboxOptions.fuse`](environment-files.md#sandboxoptions) to `false`
+in its environment file. When this setting is `false`, environment files cannot
+enable FUSE access. Cloud sandboxes do not support FUSE.
+
 #### ssh.agentForwardingEnabled {.wrap-anywhere}
 
 {{< setting-metadata type="boolean" default="true" >}}