diff --git a/changes/ticket40663 b/changes/ticket40663
new file mode 100644
index 0000000000..3992d8e2b5
--- /dev/null
+++ b/changes/ticket40663
@@ -0,0 +1,3 @@
+  o Minor bugfixes (authorities, sandbox):
+    - Allow to write file my-consensus-<flavor-name> to disk when sandbox is
+      activated. Fixes bug 40663; bugfix on 0.3.5.1-alpha.
diff --git a/src/app/main/main.c b/src/app/main/main.c
index b73d722963..7fb92c59db 100644
--- a/src/app/main/main.c
+++ b/src/app/main/main.c
@@ -922,8 +922,11 @@ sandbox_init_filter(void)
   if (options->BridgeAuthoritativeDir)
     OPEN_DATADIR_SUFFIX("networkstatus-bridges", ".tmp");
 
-  if (authdir_mode(options))
+  if (authdir_mode(options)) {
     OPEN_DATADIR("approved-routers");
+    OPEN_CACHEDIR_SUFFIX("my-consensus-microdesc", ".tmp");
+    OPEN_CACHEDIR_SUFFIX("my-consensus-ns", ".tmp");
+  }
 
   if (options->ServerDNSResolvConfFile)
     sandbox_cfg_allow_open_filename(&cfg,