diff --git a/crates/karapace-runtime/src/namespace.rs b/crates/karapace-runtime/src/namespace.rs
index 4538c87..314a88f 100644
--- a/crates/karapace-runtime/src/namespace.rs
+++ b/crates/karapace-runtime/src/namespace.rs
@@ -294,7 +294,7 @@ impl RuntimeBackend for NamespaceBackend {
         let rootfs = image_cache.rootfs_path(&resolved.cache_key);
 
         let mut sandbox = SandboxConfig::new(rootfs, &spec.env_id, &env_dir);
-        sandbox.isolate_network = spec.manifest.network_isolation;
+        sandbox.isolate_network = spec.offline || spec.manifest.network_isolation;
 
         let host = compute_host_integration(&spec.manifest);
         sandbox.bind_mounts.extend(host.bind_mounts);
diff --git a/crates/karapace-runtime/src/oci.rs b/crates/karapace-runtime/src/oci.rs
index 098e020..1700d70 100644
--- a/crates/karapace-runtime/src/oci.rs
+++ b/crates/karapace-runtime/src/oci.rs
@@ -416,7 +416,7 @@ impl RuntimeBackend for OciBackend {
         let rootfs = image_cache.rootfs_path(&resolved.cache_key);
 
         let mut sandbox = SandboxConfig::new(rootfs, &spec.env_id, &env_dir);
-        sandbox.isolate_network = spec.manifest.network_isolation;
+        sandbox.isolate_network = spec.offline || spec.manifest.network_isolation;
 
         let host = compute_host_integration(&spec.manifest);
         sandbox.bind_mounts.extend(host.bind_mounts);