diff --git a/.gitignore b/.gitignore
index 2857997ece..41e0300c8f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -75,6 +75,7 @@ src/app/**/*.js.map
 # added
 build/hub
 electron/**/*.js
+!electron/scripts/bundle-preload.js
 electron/**/*.js.map
 
 # mac os deployment
diff --git a/electron/main-window.ts b/electron/main-window.ts
index b94ff5910c..0b1a4af1d8 100644
--- a/electron/main-window.ts
+++ b/electron/main-window.ts
@@ -124,10 +124,6 @@ export const createWindow = async ({
       webSecurity: false,
       preload: path.join(__dirname, 'preload.js'),
       nodeIntegration: false,
-      // Required: preload.js uses require() for local modules (e.g. ./shared-with-frontend/ipc-events.const).
-      // Electron 20+ defaults sandbox to true, and sandboxed preloads can only require built-in Electron
-      // modules. This does NOT disable Chromium's OS-level process sandbox (that's --no-sandbox).
-      sandbox: false,
       // make remote module work with those two settings
       contextIsolation: true,
       // Additional settings for better Linux/Wayland compatibility
diff --git a/electron/scripts/bundle-preload.js b/electron/scripts/bundle-preload.js
new file mode 100644
index 0000000000..e73ba7a283
--- /dev/null
+++ b/electron/scripts/bundle-preload.js
@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+const { build } = require('esbuild');
+const path = require('path');
+
+build({
+  entryPoints: [path.join(__dirname, '..', 'preload.ts')],
+  bundle: true,
+  outfile: path.join(__dirname, '..', 'preload.js'),
+  platform: 'node',
+  target: 'es2022',
+  format: 'cjs',
+  external: ['electron'],
+  sourcemap: false,
+  logLevel: 'info',
+}).catch(() => process.exit(1));
diff --git a/package.json b/package.json
index 0ecacd6142..4224b1b50e 100644
--- a/package.json
+++ b/package.json
@@ -71,7 +71,7 @@
     "e2e:docker:webdav": "docker compose -f docker-compose.e2e.yaml up -d app webdav && ./scripts/wait-for-app.sh && ./scripts/wait-for-webdav.sh && E2E_BASE_URL=http://localhost:${APP_PORT:-4242} npm run e2e:all -- --grep @webdav; docker compose -f docker-compose.e2e.yaml down",
     "e2e:docker:all": "docker compose -f docker-compose.e2e.yaml -f docker-compose.yaml -f docker-compose.supersync.yaml up -d app webdav db supersync && ./scripts/wait-for-app.sh && ./scripts/wait-for-webdav.sh && ./scripts/wait-for-supersync.sh && E2E_BASE_URL=http://localhost:${APP_PORT:-4242} npm run e2e:all -- --workers=6; EXIT_CODE=$?; docker compose -f docker-compose.e2e.yaml -f docker-compose.yaml -f docker-compose.supersync.yaml down; exit $EXIT_CODE",
     "electron": "NODE_ENV=PROD electron .",
-    "electron:build": "tsc -p electron/tsconfig.electron.json",
+    "electron:build": "tsc -p electron/tsconfig.electron.json && node electron/scripts/bundle-preload.js",
     "electron:watch": "tsc -p electron/tsconfig.electron.json --watch",
     "electronBuilderOnly": "electron-builder",
     "empty": "echo 'EMPTY YEAH'",