diff --git a/docs/config.html b/docs/config.html
index e4d9ddded9..021d0798f4 100644
--- a/docs/config.html
+++ b/docs/config.html
@@ -918,6 +918,14 @@
+
N.B. On Ubuntu Noble (24.04) or later, sandboxing may fail with a "Permission denied" error (often referring
+ to /proc/self/setgroups). This is due to a
+ security change
+ which prohibits unprivileged user namespaces, which the sandboxing relies upon.
+ To fix this, you need to create an AppArmor profile allowing it; we have an
+ example
+ for the default install location, which you should copy to /etc/apparmor.d/build.please,
+ then run sudo systemctl reload apparmor to apply the new profile.
diff --git a/tools/misc/apparmor_profile b/tools/misc/apparmor_profile
new file mode 100644
index 0000000000..badb5184a9
--- /dev/null
+++ b/tools/misc/apparmor_profile
@@ -0,0 +1,12 @@
+# Allow Please and its sandbox binary to create unprivileged user namespaces.
+# These are used for sandboxing build actions when the appropriate config is enabled.
+
+abi ,
+include
+
+profile /home/*/.please/please /home/*/.please/please_sandbox flags=(unconfined) {
+ userns,
+
+ # Site-specific additions and overrides. See local/README for details.
+ include if exists
+}