2 files changed, 22 insertions, 9 deletions
diff --git a/modules/by-name/di/direnv/landrun-fish.sh b/modules/by-name/di/direnv/landrun-fish.sh
index 09687afb..66add23a 100755
--- a/modules/by-name/di/direnv/landrun-fish.sh
+++ b/modules/by-name/di/direnv/landrun-fish.sh
@@ -1,19 +1,22 @@
 #! /usr/bin/env sh
 
-export NO_DIRENV_LOAD=true
+_new_tmp="$(mktemp --directory -t landrun_fish_XXXXX)"
+trap 'rm --recursive "$_new_tmp"' EXIT
+
+# NOTE: We need to keep the XDG_RUNTIME_DIR, as pam_systemd sets it only once upon login. <2026-08-25>
 landrun \
-    --env PATH \
-    --env USER \
-    --env IN_NIX_SHELL \
+    --env XDG_RUNTIME_DIR \
     --env NIX_SHELL_LEVEL \
-    --env NO_DIRENV_LOAD \
+    --env TERM \
     --env SHLVL \
+    --env IN_DIRENV_SANDBOX=true \
+    --env TMPDIR="$_new_tmp" \
     --rox /nix/store \
+    --rw "$_new_tmp" \
     --ro /etc/ \
     --ro /proc/ \
     --rw /dev/ \
-    --rw "/run/user/$(id --user)" \
-    --ro "$HOME/.config" \
+    --rw "$XDG_RUNTIME_DIR" \
     --rw "$HOME/.cache" \
     --ro "$HOME/.local/share/nix/trusted-settings.json" \
     --rw "$HOME/.local/share/nix/repl-history" \
@@ -21,10 +24,15 @@ landrun \
     --rw "$HOME/.local/share/nvim/" \
     --rw "$HOME/.local/share/cargo/" \
     --rw "$HOME/.local/share/ctpv/" \
-    --rw "$HOME/.local/share/direnv" \
+    --rw "$HOME/.local/share/direnv/" \
+    --rw "$HOME/.local/share/lf/" \
     --ro "$HOME/.config/fish/" \
+    --ro "$HOME/.config/task/" \
+    --ro "$HOME/.config/nvim/" \
+    --ro "$HOME/.config/turtle/" \
+    --rwx "$PWD" \
     --connect-tcp 80 \
     --connect-tcp 443 \
-    -- fish "$@"
+    -- fish --login "$@"
 
 # vim: ft=sh
diff --git a/modules/by-name/di/direnv/module.nix b/modules/by-name/di/direnv/module.nix
index 4a1a4768..9c2975c3 100644
--- a/modules/by-name/di/direnv/module.nix
+++ b/modules/by-name/di/direnv/module.nix
@@ -53,7 +53,12 @@ in {
         end
 
         function _direnv_hook --on-event fish_preexec --on-variable PWD
+          if not set --query IN_DIRENV_SANDBOX; and set --query SHOULD_SANDBOX_DIRENV; and ${direnvPkg} status | grep 'Found RC path' --invert-match | grep 'No .envrc or .env loaded' --quiet
+            # We found a rc path, but none are loaded. So we can start our shell.
+            ${lib.getExe landrun-fish} --interactive --command='_direnv_export_eval'
+          else
             _direnv_export_eval
+          end
         end
       '';