diff --git a/CHANGELOG.md b/CHANGELOG.md
index 68a1d23..7795035 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,13 @@
 All notable changes to CodeCraft. Versions follow [Semantic Versioning](https://semver.org/);
 until 1.0, minor versions may contain breaking changes.
 
+## [Unreleased]
+
+### Fixed
+
+- **Sandbox on x86_64:** the start-up check of bubblewrap did not mount `/lib64`, so it failed
+  on amd64 hosts and shell commands of non-admin users were disabled.
+
 ## [v202611-00008] – 2026-11-09
 
 ### Added
diff --git a/server/src/sandbox.rs b/server/src/sandbox.rs
index bac3706..5e11d40 100644
--- a/server/src/sandbox.rs
+++ b/server/src/sandbox.rs
@@ -37,6 +37,8 @@ pub async fn probe() -> Result<(), String> {
     }
     let res = match Command::new("bwrap")
         .args(["--ro-bind", "/usr", "/usr", "--ro-bind", "/bin", "/bin", "--ro-bind", "/lib", "/lib", "--dev", "/dev", "--proc", "/proc"])
+        // The dynamic loader lives in /lib64 on x86_64 (/lib on arm64).
+        .args(["--ro-bind-try", "/lib64", "/lib64", "--ro-bind-try", "/lib32", "/lib32"])
         .args(["--unshare-all", "--die-with-parent", "--clearenv", "/bin/true"])
         .env_clear()
         .output()