diff --git a/apps/backend/scripts/threads-profile/scrape.mjs b/apps/backend/scripts/threads-profile/scrape.mjs
index 1d314d9..0c83d01 100644
--- a/apps/backend/scripts/threads-profile/scrape.mjs
+++ b/apps/backend/scripts/threads-profile/scrape.mjs
@@ -73,9 +73,13 @@ async function main() {
     }
   }
 
+  // No --no-sandbox: verified Chromium's own unprivileged-userns sandbox
+  // launches fine under the worker's systemd hardening (NoNewPrivileges=true
+  // + ProtectSystem=strict), so keep the renderer/GPU process sandboxed
+  // instead of trusting ProtectSystem alone against untrusted public pages.
   const browser = await chromium.launch({
     headless: true,
-    args: ["--disable-blink-features=AutomationControlled", "--no-sandbox"],
+    args: ["--disable-blink-features=AutomationControlled"],
   });
 
   try {