diff --git a/devel/sandbox-kit/spec.yaml b/devel/sandbox-kit/spec.yaml
index 31b3ea842..d370bf394 100644
--- a/devel/sandbox-kit/spec.yaml
+++ b/devel/sandbox-kit/spec.yaml
@@ -372,6 +372,7 @@ permissions:                                 # v1: `network.allowedDomains:`
                                              # resolve the buf.yaml module deps and the remote
                                              # plugins declared in the buf.gen.yaml files
       - "dl.chainloop.dev:443"               # EE CLI installer
+      - "download.chainloop.dev:443"         # CLI binary downloads the installer fetches
       - "chainloop-baafegchfnekdcde.z02.azurefd.net:443"  # EE CLI download CDN
       - "github.com:443"                     # git push over HTTPS in persistent mode - the
                                              # pre-push attestation egresses on push. Other