diff --git a/sandbox/setup.sh b/sandbox/setup.sh
index 2509fba..0225f9c 100644
--- a/sandbox/setup.sh
+++ b/sandbox/setup.sh
@@ -68,15 +68,6 @@ EOF
       mkdir -p "$(dirname "$dropin")" && mv -f "$tmp" "$dropin" && chmod 644 "$dropin" \
         && systemctl --user daemon-reload || STATUS=1
     fi
-    # The gateway reads its sandbox rules only when it starts, so restart it
-    # when they or the drop-in change
-    stamp="$HOME/.local/state/coredesktop/hermes-gateway-sandbox"
-    rules="$(cat "$dropin" "$COREDESKTOP/sandbox/agent" "$COREDESKTOP"/sandbox/config/{base,hermes}.json \
-      "$HOME"/.config/coredesktop/sandbox/{base,hermes}.json 2> /dev/null | sha256sum)"
-    if [ "$rules" != "$(cat "$stamp" 2> /dev/null)" ]; then
-      systemctl --user try-restart hermes-gateway.service \
-        && mkdir -p "$(dirname "$stamp")" && echo "$rules" > "$stamp" || STATUS=1
-    fi
   else
     echo "Hermes' gateway isn't sandboxed yet: the sandbox (srt) isn't installed."
     STATUS=1
diff --git a/updates.d/72-sandbox.sh b/updates.d/72-sandbox.sh
index 13b9700..ceda183 100644
--- a/updates.d/72-sandbox.sh
+++ b/updates.d/72-sandbox.sh
@@ -12,5 +12,12 @@ run_update() {
     echo "Updating Hermes Agent..."
     "$HOME/.local/bin/hermes" update < /dev/null || status=1
   fi
+
+  # The gateway reads its sandbox rules and loads new dependencies only when it
+  # starts, and Hermes restarts it only for new code
+  if systemctl --user is-active --quiet hermes-gateway.service; then
+    echo "Restarting Hermes' gateway..."
+    systemctl --user restart hermes-gateway.service || status=1
+  fi
   return $status
 }