diff --git a/internal/sandbox/runner_windows_integration_test.go b/internal/sandbox/runner_windows_integration_test.go
index 22a61bfa5..708f43e4c 100644
--- a/internal/sandbox/runner_windows_integration_test.go
+++ b/internal/sandbox/runner_windows_integration_test.go
@@ -145,12 +145,22 @@ func TestWindowsUnelevatedRealSandboxSmoke(t *testing.T) {
 
 	root := t.TempDir()
 	outside := t.TempDir()
+	privateDir := filepath.Join(root, "private")
+	if err := os.MkdirAll(privateDir, 0o700); err != nil {
+		t.Fatalf("MkdirAll private: %v", err)
+	}
+	secretFile := filepath.Join(privateDir, "secret.txt")
+	if err := os.WriteFile(secretFile, []byte("super-secret"), 0o600); err != nil {
+		t.Fatalf("WriteFile secret: %v", err)
+	}
+
 	sandboxHome := filepath.Join(root, ".zero-sandbox")
 	profile := PermissionProfile{
 		FileSystem: FileSystemPolicy{
 			Kind:                 FileSystemRestricted,
 			ReadRoots:            []string{root},
 			WriteRoots:           []WritableRoot{{Root: root, ProtectedMetadataNames: []string{".git", ".zero", ".agents"}}},
+			DenyRead:             []string{privateDir},
 			IncludePlatformRoots: true,
 			AllowTemp:            true,
 		},
@@ -179,6 +189,11 @@ func TestWindowsUnelevatedRealSandboxSmoke(t *testing.T) {
 		t.Fatalf("expected the unelevated setup marker to be recorded: %v", err)
 	}
 
+	// DenyRead check: reading from the privateDir must be blocked (exit code 1)
+	runWindowsRealSmokeCommand(t, runnerExe, config, []string{
+		"cmd.exe", "/d", "/s", "/c", "type " + secretFile,
+	}, 1)
+
 	outsideMarker := filepath.Join(outside, "unelevated-write-denied.txt")
 	runWindowsRealSmokeCommand(t, runnerExe, config, []string{
 		"cmd.exe", "/d", "/s", "/c", "echo leaked>" + outsideMarker,
diff --git a/internal/sandbox/windows_token_windows.go b/internal/sandbox/windows_token_windows.go
index f95661371..5c5498e74 100644
--- a/internal/sandbox/windows_token_windows.go
+++ b/internal/sandbox/windows_token_windows.go
@@ -105,7 +105,7 @@ func createWindowsRestrictedTokenFromBase(base windows.Token, capabilitySIDs []w
 	var restricted windows.Token
 	result, _, callErr := procCreateRestrictedToken.Call(
 		uintptr(base),
-		uintptr(windowsDisableMaxPrivilege|windowsLUAToken|windowsWriteRestricted),
+		uintptr(windowsDisableMaxPrivilege|windowsLUAToken),
 		0,
 		0,
 		0,