diff --git a/sandboxes/base/policy.yaml b/sandboxes/base/policy.yaml
index 98637fe4..b8cacda5 100644
--- a/sandboxes/base/policy.yaml
+++ b/sandboxes/base/policy.yaml
@@ -101,8 +101,8 @@ network_policies:
     name: copilot
     endpoints:
       # Auth and user management
-      - { host: github.com, port: 443 }
-      - { host: api.github.com, port: 443 }
+      - { host: github.com, port: 443, allow_uninspected_credentials: true }
+      - { host: api.github.com, port: 443, allow_uninspected_credentials: true }
       # Copilot API (subscription-tier routing)
       - { host: api.githubcopilot.com, port: 443, protocol: rest, enforcement: enforce, access: read-write }
       - { host: api.individual.githubcopilot.com, port: 443, protocol: rest, enforcement: enforce, access: read-write }
@@ -125,10 +125,10 @@ network_policies:
       - { host: pypi.org, port: 443 }
       - { host: files.pythonhosted.org, port: 443 }
       # uv python install downloads from python-build-standalone on GitHub
-      - { host: github.com, port: 443 }
+      - { host: github.com, port: 443, allow_uninspected_credentials: true }
       - { host: objects.githubusercontent.com, port: 443 }
       # uv resolves python-build-standalone release metadata via the GitHub API
-      - { host: api.github.com, port: 443 }
+      - { host: api.github.com, port: 443, allow_uninspected_credentials: true }
       - { host: downloads.python.org, port: 443 }
     binaries:
       - { path: /sandbox/.venv/bin/python }
diff --git a/sandboxes/droid/policy.yaml b/sandboxes/droid/policy.yaml
index 7b48020c..144ff9bd 100644
--- a/sandboxes/droid/policy.yaml
+++ b/sandboxes/droid/policy.yaml
@@ -126,9 +126,9 @@ network_policies:
     endpoints:
       - { host: pypi.org, port: 443 }
       - { host: files.pythonhosted.org, port: 443 }
-      - { host: github.com, port: 443 }
+      - { host: github.com, port: 443, allow_uninspected_credentials: true }
       - { host: objects.githubusercontent.com, port: 443 }
-      - { host: api.github.com, port: 443 }
+      - { host: api.github.com, port: 443, allow_uninspected_credentials: true }
       - { host: downloads.python.org, port: 443 }
     binaries:
       - { path: /sandbox/.venv/bin/python }
diff --git a/sandboxes/gemini/policy.yaml b/sandboxes/gemini/policy.yaml
index 22218f2e..e37d823f 100644
--- a/sandboxes/gemini/policy.yaml
+++ b/sandboxes/gemini/policy.yaml
@@ -108,10 +108,10 @@ network_policies:
       - { host: pypi.org, port: 443 }
       - { host: files.pythonhosted.org, port: 443 }
       # uv python install downloads from python-build-standalone on GitHub
-      - { host: github.com, port: 443 }
+      - { host: github.com, port: 443, allow_uninspected_credentials: true }
       - { host: objects.githubusercontent.com, port: 443 }
       # uv resolves python-build-standalone release metadata via the GitHub API
-      - { host: api.github.com, port: 443 }
+      - { host: api.github.com, port: 443, allow_uninspected_credentials: true }
       - { host: downloads.python.org, port: 443 }
     binaries:
       - { path: /sandbox/.venv/bin/python }
@@ -170,8 +170,8 @@ network_policies:
   copilot:
     name: copilot
     endpoints:
-      - { host: github.com, port: 443 }
-      - { host: api.github.com, port: 443 }
+      - { host: github.com, port: 443, allow_uninspected_credentials: true }
+      - { host: api.github.com, port: 443, allow_uninspected_credentials: true }
       - { host: api.githubcopilot.com, port: 443 }
       - { host: api.enterprise.githubcopilot.com, port: 443 }
       - { host: release-assets.githubusercontent.com, port: 443 }
diff --git a/sandboxes/ollama/policy.yaml b/sandboxes/ollama/policy.yaml
index efe680f4..bea9f575 100644
--- a/sandboxes/ollama/policy.yaml
+++ b/sandboxes/ollama/policy.yaml
@@ -42,7 +42,7 @@ network_policies:
       - { host: registry.ollama.com, port: 443 }
       - { host: registry.ollama.ai, port: 443 }
       - { host: "*.r2.cloudflarestorage.com", port: 443 }
-      - { host: github.com, port: 443 }
+      - { host: github.com, port: 443, allow_uninspected_credentials: true }
       - { host: objects.githubusercontent.com, port: 443 }
       - { host: raw.githubusercontent.com, port: 443 }
       - { host: release-assets.githubusercontent.com, port: 443 }
diff --git a/sandboxes/pi/policy.yaml b/sandboxes/pi/policy.yaml
index cf22a12c..93faa0df 100644
--- a/sandboxes/pi/policy.yaml
+++ b/sandboxes/pi/policy.yaml
@@ -75,8 +75,8 @@ network_policies:
       - { host: platform.claude.com, port: 443 }
       - { host: auth.openai.com, port: 443 }
       - { host: chatgpt.com, port: 443 }
-      - { host: github.com, port: 443 }
-      - { host: api.github.com, port: 443 }
+      - { host: github.com, port: 443, allow_uninspected_credentials: true }
+      - { host: api.github.com, port: 443, allow_uninspected_credentials: true }
       # pi downloads managed fd/ripgrep binaries from GitHub release assets.
       - { host: release-assets.githubusercontent.com, port: 443 }
       - { host: api.githubcopilot.com, port: 443 }
@@ -145,10 +145,10 @@ network_policies:
       - { host: pypi.org, port: 443 }
       - { host: files.pythonhosted.org, port: 443 }
       # uv python install downloads from python-build-standalone on GitHub
-      - { host: github.com, port: 443 }
+      - { host: github.com, port: 443, allow_uninspected_credentials: true }
       - { host: objects.githubusercontent.com, port: 443 }
       # uv resolves python-build-standalone release metadata via the GitHub API
-      - { host: api.github.com, port: 443 }
+      - { host: api.github.com, port: 443, allow_uninspected_credentials: true }
       - { host: downloads.python.org, port: 443 }
     binaries:
       - { path: /sandbox/.venv/bin/python }