diff --git a/cmd/wireproxy/main.go b/cmd/wireproxy/main.go
index 713943a..b08f768 100644
--- a/cmd/wireproxy/main.go
+++ b/cmd/wireproxy/main.go
@@ -80,6 +80,7 @@ func lock(stage string) {
 		// Linux
 		panicIfError(landlock.V1.BestEffort().RestrictPaths(
 			landlock.RODirs("/"),
+			landlock.RWFiles("/dev/null").IgnoreIfMissing(),
 		))
 	case "boot-daemon":
 	case "read-config":