diff --git a/sandbox/setup.sh b/sandbox/setup.sh
index e435ab5..2509fba 100644
--- a/sandbox/setup.sh
+++ b/sandbox/setup.sh
@@ -66,8 +66,16 @@ EOF
     else
       echo "Running Hermes' gateway in the sandbox..."
       mkdir -p "$(dirname "$dropin")" && mv -f "$tmp" "$dropin" && chmod 644 "$dropin" \
-        && systemctl --user daemon-reload \
-        && systemctl --user try-restart hermes-gateway.service || STATUS=1
+        && systemctl --user daemon-reload || STATUS=1
+    fi
+    # The gateway reads its sandbox rules only when it starts, so restart it
+    # when they or the drop-in change
+    stamp="$HOME/.local/state/coredesktop/hermes-gateway-sandbox"
+    rules="$(cat "$dropin" "$COREDESKTOP/sandbox/agent" "$COREDESKTOP"/sandbox/config/{base,hermes}.json \
+      "$HOME"/.config/coredesktop/sandbox/{base,hermes}.json 2> /dev/null | sha256sum)"
+    if [ "$rules" != "$(cat "$stamp" 2> /dev/null)" ]; then
+      systemctl --user try-restart hermes-gateway.service \
+        && mkdir -p "$(dirname "$stamp")" && echo "$rules" > "$stamp" || STATUS=1
     fi
   else
     echo "Hermes' gateway isn't sandboxed yet: the sandbox (srt) isn't installed."