diff --git a/boot/kernel/sandbox.config b/boot/kernel/sandbox.config
index d22133a9..bf99bee1 100644
--- a/boot/kernel/sandbox.config
+++ b/boot/kernel/sandbox.config
@@ -49,6 +49,10 @@ CONFIG_AUTOFS_FS=y
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_BLK_DEV_INITRD=y
+
+## fanotify for userspace file monitors; defconfig leaves it off and
+## fanotify_init() answers ENOSYS. Software-only: no listener, no work.
+CONFIG_FANOTIFY=y
 # Entropy: since 6.2 the kernel trusts CPU/bootloader seeds by default
 # (random.trust_cpu removed as a Kconfig) — no boot-time entropy stall.