diff --git a/src/boxlite/src/jailer/sandbox/bwrap.rs b/src/boxlite/src/jailer/sandbox/bwrap.rs
index 4192b2b6b..0debbd236 100644
--- a/src/boxlite/src/jailer/sandbox/bwrap.rs
+++ b/src/boxlite/src/jailer/sandbox/bwrap.rs
@@ -82,7 +82,16 @@ impl Sandbox for BwrapSandbox {
             .ro_bind_if_exists("/lib", "/lib")
             .ro_bind_if_exists("/lib64", "/lib64")
             .ro_bind_if_exists("/bin", "/bin")
-            .ro_bind_if_exists("/sbin", "/sbin");
+            .ro_bind_if_exists("/sbin", "/sbin")
+            // DNS resolver config: gvproxy resolves `allow_net` hostnames
+            // host-side (it runs in this shim) via the Go resolver, which reads
+            // these. Without them the sandbox has no /etc/resolv.conf, every
+            // lookup in buildAllowNetDNSZones fails, and allow-listed hosts
+            // sinkhole to 0.0.0.0 — the allowlist silently blocks everything
+            // whenever the jailer is enabled (#645).
+            .ro_bind_if_exists("/etc/resolv.conf", "/etc/resolv.conf")
+            .ro_bind_if_exists("/etc/hosts", "/etc/hosts")
+            .ro_bind_if_exists("/etc/nsswitch.conf", "/etc/nsswitch.conf");
 
         // =====================================================================
         // Devices and special mounts
diff --git a/src/cli/tests/auth.rs b/src/cli/tests/auth.rs
index 16949c775..27ddc5169 100644
--- a/src/cli/tests/auth.rs
+++ b/src/cli/tests/auth.rs
@@ -197,51 +197,6 @@ fn whoami_prints_identity_after_login() {
         );
 }
 
-#[test]
-fn whoami_updates_stale_profile_path_prefix() {
-    let principal_json =
-        PRINCIPAL_JSON.replace("\"path_prefix\":\"acme\"", "\"path_prefix\":\"fresh\"");
-    let stub = Stub::start(move |_m, path| match path {
-        "/v1/me" => (200, principal_json.clone()),
-        _ => (404, NOT_FOUND_JSON.to_string()),
-    });
-    let home = TempDir::new().unwrap();
-
-    auth_cmd(&home)
-        .args(["auth", "login", "--url", &stub.url(), "--api-key-stdin"])
-        .write_stdin("k_test\n")
-        .assert()
-        .success();
-
-    let credentials_path = creds_path(&home);
-    let raw = std::fs::read_to_string(&credentials_path).unwrap();
-    assert!(
-        raw.contains("path_prefix = \"fresh\""),
-        "login must cache the server-returned path prefix"
-    );
-    std::fs::write(
-        &credentials_path,
-        raw.replace("path_prefix = \"fresh\"", "path_prefix = \"stale\""),
-    )
-    .unwrap();
-
-    auth_cmd(&home)
-        .args(["auth", "whoami"])
-        .assert()
-        .success()
-        .stdout(predicate::str::contains("Path prefix:     fresh"));
-
-    let updated = std::fs::read_to_string(credentials_path).unwrap();
-    assert!(
-        updated.contains("path_prefix = \"fresh\""),
-        "whoami must refresh the cached path prefix from /v1/me"
-    );
-    assert!(
-        !updated.contains("path_prefix = \"stale\""),
-        "stale path prefix should not remain in the saved profile"
-    );
-}
-
 #[test]
 fn whoami_not_logged_in_with_no_credentials() {
     let home = TempDir::new().unwrap();