diff --git a/apps/web/src/app/(app)/cloud/webhooks/[triggerId]/EditWebhookTriggerContent.tsx b/apps/web/src/app/(app)/cloud/webhooks/[triggerId]/EditWebhookTriggerContent.tsx
index b2e5847431..d047430439 100644
--- a/apps/web/src/app/(app)/cloud/webhooks/[triggerId]/EditWebhookTriggerContent.tsx
+++ b/apps/web/src/app/(app)/cloud/webhooks/[triggerId]/EditWebhookTriggerContent.tsx
@@ -41,6 +41,10 @@ export function EditWebhookTriggerContent({
   // Build URLs based on context
   const routes = getWebhookRoutes(organizationId);
 
+  const { data: capabilities, isPending: isLoadingCapabilities } = useQuery(
+    trpc.webhookTriggers.capabilities.queryOptions({ organizationId })
+  );
+
   // Fetch trigger configuration
   const {
     data: triggerData,
@@ -110,6 +114,7 @@ export function EditWebhookTriggerContent({
       mode: (triggerData.mode ?? 'code') as AgentMode,
       model: triggerData.model ?? '',
       variant: triggerData.variant ?? undefined,
+      sandboxAllocation: triggerData.sandboxAllocation ?? undefined,
       promptTemplate: triggerData.promptTemplate,
       profileId: triggerData.profileId ?? undefined,
       autoCommit: triggerData.autoCommit ?? undefined,
@@ -162,6 +167,7 @@ export function EditWebhookTriggerContent({
         mode: formData.mode,
         model: formData.model,
         variant: formData.variant,
+        sandboxAllocation: formData.sandboxAllocation,
         promptTemplate: formData.promptTemplate,
         profileId: formData.profileId,
         autoCommit: formData.autoCommit ?? null,
@@ -381,6 +387,8 @@ export function EditWebhookTriggerContent({
           repositoriesError={repoError?.message}
           models={modelOptions}
           isLoadingModels={isLoadingModels}
+          canSetSandboxAllocation={capabilities?.canSetSandboxAllocation ?? false}
+          isLoadingCapabilities={isLoadingCapabilities}
           onSubmit={handleSubmit}
           onCancel={handleCancel}
           onDelete={handleDelete}
diff --git a/apps/web/src/app/(app)/cloud/webhooks/new/CreateWebhookTriggerContent.tsx b/apps/web/src/app/(app)/cloud/webhooks/new/CreateWebhookTriggerContent.tsx
index ddd4cc9404..130953d246 100644
--- a/apps/web/src/app/(app)/cloud/webhooks/new/CreateWebhookTriggerContent.tsx
+++ b/apps/web/src/app/(app)/cloud/webhooks/new/CreateWebhookTriggerContent.tsx
@@ -34,7 +34,9 @@ export function CreateWebhookTriggerContent({ organizationId }: CreateWebhookTri
     ? `/organizations/${organizationId}/integrations`
     : '/integrations';
 
-  // Fetch eligibility to check if user can create webhook triggers (requires credits)
+  const { data: capabilities, isPending: isLoadingCapabilities } = useQuery(
+    trpc.webhookTriggers.capabilities.queryOptions({ organizationId })
+  );
 
   // Fetch GitHub repositories
   const {
@@ -118,6 +120,7 @@ export function CreateWebhookTriggerContent({ organizationId }: CreateWebhookTri
         mode: formData.mode,
         model: formData.model,
         variant: formData.variant ?? undefined,
+        sandboxAllocation: formData.sandboxAllocation ?? undefined,
         promptTemplate: formData.promptTemplate,
         profileId: formData.profileId,
         autoCommit: formData.autoCommit,
@@ -203,6 +206,8 @@ export function CreateWebhookTriggerContent({ organizationId }: CreateWebhookTri
         repositoriesError={repoError?.message}
         models={modelOptions}
         isLoadingModels={isLoadingModels}
+        canSetSandboxAllocation={capabilities?.canSetSandboxAllocation ?? false}
+        isLoadingCapabilities={isLoadingCapabilities}
         onSubmit={handleSubmit}
         onCancel={handleCancel}
         isLoading={isCreatePending}
diff --git a/apps/web/src/components/webhook-triggers/TriggerForm.test.ts b/apps/web/src/components/webhook-triggers/TriggerForm.test.ts
index ac9b52271a..690a747d82 100644
--- a/apps/web/src/components/webhook-triggers/TriggerForm.test.ts
+++ b/apps/web/src/components/webhook-triggers/TriggerForm.test.ts
@@ -31,6 +31,74 @@ jest.mock('@/components/ui/label', () => ({
 }));
 jest.mock('@/components/ui/switch', () => ({ Switch: () => null }));
 jest.mock('@/components/ui/checkbox', () => ({ Checkbox: () => null }));
+type SelectInjectedProps = {
+  onValueChange?: (value: string) => void;
+  selectDisabled?: boolean;
+};
+
+jest.mock('@/components/ui/select', () => ({
+  Select: ({
+    children,
+    value,
+    onValueChange,
+    disabled,
+  }: {
+    children: React.ReactNode;
+    value: string;
+    onValueChange: (value: string) => void;
+    disabled?: boolean;
+  }) =>
+    createElement(
+      'div',
+      { 'data-container-allocation': value, 'data-disabled': String(disabled) },
+      React.Children.map(children, child => {
+        if (!React.isValidElement<SelectInjectedProps>(child)) return child;
+        return React.cloneElement(child, { onValueChange, selectDisabled: disabled });
+      })
+    ),
+  SelectTrigger: ({ children }: { children: React.ReactNode }) =>
+    createElement(React.Fragment, {}, children),
+  SelectValue: () => null,
+  SelectContent: ({
+    children,
+    onValueChange,
+    selectDisabled,
+  }: {
+    children: React.ReactNode;
+    onValueChange?: (value: string) => void;
+    selectDisabled?: boolean;
+  }) =>
+    createElement(
+      React.Fragment,
+      {},
+      React.Children.map(children, child => {
+        if (!React.isValidElement<SelectInjectedProps>(child)) return child;
+        return React.cloneElement(child, { onValueChange, selectDisabled });
+      })
+    ),
+  SelectItem: ({
+    children,
+    value,
+    disabled,
+    onValueChange,
+    selectDisabled,
+  }: {
+    children: React.ReactNode;
+    value: string;
+    disabled?: boolean;
+    onValueChange?: (value: string) => void;
+    selectDisabled?: boolean;
+  }) =>
+    createElement(
+      'button',
+      {
+        type: 'button',
+        disabled: disabled || selectDisabled,
+        onClick: () => onValueChange?.(value),
+      },
+      children
+    ),
+}));
 jest.mock('@/components/ui/inline-delete-confirmation', () => ({
   InlineDeleteConfirmation: () => null,
 }));
@@ -192,6 +260,21 @@ function expectSubmittedVariantToBeOmitted(onSubmit: jest.Mock<TriggerFormProps[
   expect(Object.hasOwn(submission, 'variant')).toBe(false);
 }
 
+function selectContainerAllocation(
+  container: HTMLElement,
+  value: 'automatic' | 'isolated-standard'
+) {
+  click(container, value === 'automatic' ? 'Automatic' : 'Dedicated Standard');
+}
+
+function expectSubmittedSandboxAllocationToBeOmitted(
+  onSubmit: jest.Mock<TriggerFormProps['onSubmit']>
+) {
+  const [submission] = onSubmit.mock.calls.at(-1) ?? [];
+  if (!submission) throw new Error('form submission missing');
+  expect(Object.hasOwn(submission, 'sandboxAllocation')).toBe(false);
+}
+
 let TriggerForm!: typeof TriggerFormComponent;
 
 beforeAll(async () => {
@@ -335,3 +418,149 @@ describe('TriggerForm variants', () => {
     ).toHaveProperty('disabled', true);
   });
 });
+
+describe('TriggerForm container allocation', () => {
+  let root: Root | undefined;
+  let cleanup: (() => void) | undefined;
+
+  afterEach(() => {
+    if (root) act(() => root?.unmount());
+    root = undefined;
+    cleanup?.();
+    cleanup = undefined;
+  });
+
+  function render(props: Partial<TriggerFormProps>) {
+    const dom = installDom();
+    cleanup = dom.cleanup;
+    root = createRoot(dom.container);
+    const onSubmit = jest.fn<TriggerFormProps['onSubmit']>();
+    onSubmit.mockResolvedValue(undefined);
+    const allProps: TriggerFormProps = {
+      mode: 'edit',
+      initialData: initialData(),
+      repositories: [],
+      models,
+      onSubmit,
+      canSetSandboxAllocation: true,
+      ...props,
+    };
+    act(() => root?.render(createElement(TriggerForm, allProps)));
+    return { container: dom.container, onSubmit, allProps };
+  }
+
+  it('omits Automatic and submits Dedicated Standard in create mode', async () => {
+    const mounted = render({ mode: 'create', initialData: initialData() });
+    submit(mounted.container);
+    await act(async () => Promise.resolve());
+    expectSubmittedSandboxAllocationToBeOmitted(mounted.onSubmit);
+
+    selectContainerAllocation(mounted.container, 'isolated-standard');
+    submit(mounted.container);
+    await act(async () => Promise.resolve());
+    expect(mounted.onSubmit).toHaveBeenLastCalledWith(
+      expect.objectContaining({ sandboxAllocation: 'isolated-standard' })
+    );
+  });
+
+  it('omits unchanged edit allocation and supports set, clear, and restoring the saved value', async () => {
+    const unset = render({ initialData: initialData() });
+    submit(unset.container);
+    await act(async () => Promise.resolve());
+    expectSubmittedSandboxAllocationToBeOmitted(unset.onSubmit);
+
+    selectContainerAllocation(unset.container, 'isolated-standard');
+    submit(unset.container);
+    await act(async () => Promise.resolve());
+    expect(unset.onSubmit).toHaveBeenLastCalledWith(
+      expect.objectContaining({ sandboxAllocation: 'isolated-standard' })
+    );
+
+    act(() => root?.unmount());
+    const saved = { ...initialData(), sandboxAllocation: 'isolated-standard' as const };
+    const mounted = render({ initialData: saved });
+    submit(mounted.container);
+    await act(async () => Promise.resolve());
+    expectSubmittedSandboxAllocationToBeOmitted(mounted.onSubmit);
+
+    selectContainerAllocation(mounted.container, 'automatic');
+    submit(mounted.container);
+    await act(async () => Promise.resolve());
+    expect(mounted.onSubmit).toHaveBeenLastCalledWith(
+      expect.objectContaining({ sandboxAllocation: null })
+    );
+
+    selectContainerAllocation(mounted.container, 'isolated-standard');
+    submit(mounted.container);
+    await act(async () => Promise.resolve());
+    expectSubmittedSandboxAllocationToBeOmitted(mounted.onSubmit);
+  });
+
+  it('hides fresh allocation from ineligible users but preserves a saved allocation and clearing it', async () => {
+    const fresh = render({ canSetSandboxAllocation: false });
+    expect(fresh.container.querySelector('[data-container-allocation]')).toBeNull();
+
+    act(() => root?.unmount());
+    const saved = render({
+      canSetSandboxAllocation: false,
+      initialData: { ...initialData(), sandboxAllocation: 'isolated-standard' },
+    });
+    expect(saved.container.querySelector('[data-container-allocation]')).not.toBeNull();
+    selectContainerAllocation(saved.container, 'automatic');
+    submit(saved.container);
+    await act(async () => Promise.resolve());
+    expect(saved.onSubmit).toHaveBeenLastCalledWith(
+      expect.objectContaining({ sandboxAllocation: null })
+    );
+  });
+
+  it('blocks a pending allocation selection after eligibility is revoked until Automatic is restored', async () => {
+    const mounted = render({ mode: 'create' });
+    selectContainerAllocation(mounted.container, 'isolated-standard');
+    act(() =>
+      root?.render(
+        createElement(TriggerForm, { ...mounted.allProps, canSetSandboxAllocation: false })
+      )
+    );
+    submit(mounted.container);
+    expect(mounted.onSubmit).not.toHaveBeenCalled();
+
+    expect(mounted.container.querySelector('[data-container-allocation]')).not.toBeNull();
+    selectContainerAllocation(mounted.container, 'automatic');
+    submit(mounted.container);
+    await act(async () => Promise.resolve());
+    expectSubmittedSandboxAllocationToBeOmitted(mounted.onSubmit);
+  });
+
+  it('blocks a new Dedicated Standard selection while capabilities are loading', () => {
+    const mounted = render({ mode: 'create', isLoadingCapabilities: true });
+    act(() =>
+      root?.render(
+        createElement(TriggerForm, { ...mounted.allProps, isLoadingCapabilities: false })
+      )
+    );
+    selectContainerAllocation(mounted.container, 'isolated-standard');
+    act(() =>
+      root?.render(createElement(TriggerForm, { ...mounted.allProps, isLoadingCapabilities: true }))
+    );
+    submit(mounted.container);
+    expect(mounted.onSubmit).not.toHaveBeenCalled();
+  });
+
+  it('resets from refreshed initial data and disables while capabilities load', () => {
+    const mounted = render({});
+    selectContainerAllocation(mounted.container, 'isolated-standard');
+    act(() =>
+      root?.render(
+        createElement(TriggerForm, {
+          ...mounted.allProps,
+          initialData: { ...initialData(), sandboxAllocation: null },
+          isLoadingCapabilities: true,
+        })
+      )
+    );
+    const select = mounted.container.querySelector('[data-container-allocation]');
+    expect(select?.getAttribute('data-container-allocation')).toBe('automatic');
+    expect(select?.getAttribute('data-disabled')).toBe('true');
+  });
+});
diff --git a/apps/web/src/components/webhook-triggers/TriggerForm.tsx b/apps/web/src/components/webhook-triggers/TriggerForm.tsx
index 0a972bace0..18d0ffceec 100644
--- a/apps/web/src/components/webhook-triggers/TriggerForm.tsx
+++ b/apps/web/src/components/webhook-triggers/TriggerForm.tsx
@@ -8,6 +8,13 @@ import { Label } from '@/components/ui/label';
 import { Textarea } from '@/components/ui/textarea';
 import { Switch } from '@/components/ui/switch';
 import { Checkbox } from '@/components/ui/checkbox';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
 import { ProfileSelector } from '@/components/cloud-agent/ProfileSelector';
 import { RepositoryCombobox, type RepositoryOption } from '@/components/shared/RepositoryCombobox';
 import { ModeCombobox } from '@/components/shared/ModeCombobox';
@@ -44,6 +51,7 @@ export type TriggerFormData = {
   mode: AgentMode;
   model: string;
   variant?: string | null;
+  sandboxAllocation?: 'isolated-standard' | null;
   promptTemplate: string;
   profileId: string;
   autoCommit?: boolean;
@@ -68,6 +76,7 @@ export type TriggerFormProps = {
     mode: AgentMode;
     model: string;
     variant?: string;
+    sandboxAllocation?: 'isolated-standard' | null;
     promptTemplate: string;
     profileId?: string;
     autoCommit?: boolean;
@@ -87,6 +96,8 @@ export type TriggerFormProps = {
   onCancel?: () => void;
   onDelete?: () => Promise<void>;
   isLoading?: boolean;
+  canSetSandboxAllocation?: boolean;
+  isLoadingCapabilities?: boolean;
   /** Full inbound webhook URL (only needed in edit mode) */
   inboundUrl?: string;
 };
@@ -114,6 +125,8 @@ export function TriggerForm({
   onCancel,
   onDelete,
   isLoading = false,
+  canSetSandboxAllocation = false,
+  isLoadingCapabilities = false,
   inboundUrl,
 }: TriggerFormProps) {
   const isEditMode = formMode === 'edit';
@@ -133,6 +146,16 @@ export function TriggerForm({
   const [agentMode, setAgentMode] = useState<AgentMode>((initialData?.mode as AgentMode) ?? 'ask');
   const [model, setModel] = useState(initialData?.model ?? '');
   const [variant, setVariant] = useState(initialData?.variant);
+  const initialSandboxAllocation =
+    initialData?.sandboxAllocation === 'isolated-standard' ? 'isolated-standard' : 'automatic';
+  const [sandboxAllocation, setSandboxAllocation] = useState<'automatic' | 'isolated-standard'>(
+    initialSandboxAllocation
+  );
+  const hasSavedSandboxAllocation = initialSandboxAllocation === 'isolated-standard';
+  const showSandboxAllocation =
+    canSetSandboxAllocation ||
+    hasSavedSandboxAllocation ||
+    sandboxAllocation === 'isolated-standard';
   const modelVariants = models.find(option => option.id === model)?.variants ?? [];
 
   const handleModelChange = (nextModel: string) => {
@@ -171,6 +194,7 @@ export function TriggerForm({
       setAgentMode(initialData.mode ?? 'ask');
       setModel(initialData.model);
       setVariant(initialData.variant);
+      setSandboxAllocation(initialData.sandboxAllocation ?? 'automatic');
       setPromptTemplate(initialData.promptTemplate);
       setProfileId(initialData.profileId ?? null);
       setAutoCommit(initialData.autoCommit ?? false);
@@ -182,6 +206,7 @@ export function TriggerForm({
     if (!initialData) {
       setWebhookAuthEnabled(false);
       setWebhookAuthHeader('');
+      setSandboxAllocation('automatic');
     }
     setWebhookAuthSecret('');
   }, [initialData]);
@@ -297,6 +322,16 @@ export function TriggerForm({
       errors.push(webhookAuthSecretError);
     }
 
+    const requiresSandboxAllocationEligibility =
+      sandboxAllocation === 'isolated-standard' &&
+      (!isEditMode || sandboxAllocation !== initialSandboxAllocation);
+    if (
+      requiresSandboxAllocationEligibility &&
+      (!canSetSandboxAllocation || isLoadingCapabilities)
+    ) {
+      errors.push('Dedicated Standard allocation is not available');
+    }
+
     return errors;
   }, [
     activeTriggerIdSchema,
@@ -309,6 +344,11 @@ export function TriggerForm({
     profileId,
     webhookAuthHeaderError,
     webhookAuthSecretError,
+    sandboxAllocation,
+    initialSandboxAllocation,
+    isEditMode,
+    canSetSandboxAllocation,
+    isLoadingCapabilities,
   ]);
 
   const isFormValid = formErrors.length === 0;
@@ -337,6 +377,15 @@ export function TriggerForm({
           ? undefined
           : (variant ?? null)
         : variant;
+      const submittedSandboxAllocation = isEditMode
+        ? sandboxAllocation === initialSandboxAllocation
+          ? undefined
+          : sandboxAllocation === 'automatic'
+            ? null
+            : sandboxAllocation
+        : sandboxAllocation === 'isolated-standard'
+          ? sandboxAllocation
+          : undefined;
 
       await onSubmit({
         triggerId,
@@ -347,6 +396,9 @@ export function TriggerForm({
         mode: agentMode,
         model,
         ...(submittedVariant !== undefined ? { variant: submittedVariant } : {}),
+        ...(submittedSandboxAllocation !== undefined
+          ? { sandboxAllocation: submittedSandboxAllocation }
+          : {}),
         promptTemplate: promptTemplate.trim(),
         profileId,
         autoCommit,
@@ -369,6 +421,8 @@ export function TriggerForm({
       model,
       variant,
       initialData?.variant,
+      sandboxAllocation,
+      initialSandboxAllocation,
       promptTemplate,
       autoCommit,
       condenseOnComplete,
@@ -570,6 +624,49 @@ export function TriggerForm({
               isScheduled={isScheduled}
             />
 
+            {showSandboxAllocation && (
+              <div className="space-y-2">
+                <Label htmlFor="sandboxAllocation">Container allocation</Label>
+                <Select
+                  value={sandboxAllocation}
+                  onValueChange={value => {
+                    if (value === 'automatic' || value === 'isolated-standard') {
+                      setSandboxAllocation(value);
+                    }
+                  }}
+                  disabled={isLoading || isLoadingCapabilities}
+                >
+                  <SelectTrigger
+                    id="sandboxAllocation"
+                    className="w-full sm:w-80"
+                    aria-describedby="sandboxAllocationHelp"
+                  >
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value="automatic">Automatic</SelectItem>
+                    <SelectItem
+                      value="isolated-standard"
+                      disabled={!canSetSandboxAllocation && !hasSavedSandboxAllocation}
+                    >
+                      Dedicated Standard
+                    </SelectItem>
+                  </SelectContent>
+                </Select>
+                <p id="sandboxAllocationHelp" className="text-muted-foreground max-w-prose text-xs">
+                  Automatic uses existing Cloud Agent routing. Dedicated Standard provisions one
+                  container per execution with 4 vCPU, 12 GiB RAM, and 20 GB disk, which may affect
+                  compute charges.
+                </p>
+                {!canSetSandboxAllocation && hasSavedSandboxAllocation && (
+                  <p className="text-muted-foreground text-xs">
+                    Only Kilo admins can newly enable Dedicated Standard. You can keep this
+                    allocation or clear it.
+                  </p>
+                )}
+              </div>
+            )}
+
             {/* Profile Selection (Required) */}
             <div className="space-y-2">
               <Label>
diff --git a/apps/web/src/lib/webhook-agent/webhook-agent-client.test.ts b/apps/web/src/lib/webhook-agent/webhook-agent-client.test.ts
index c541b7a313..453540ba76 100644
--- a/apps/web/src/lib/webhook-agent/webhook-agent-client.test.ts
+++ b/apps/web/src/lib/webhook-agent/webhook-agent-client.test.ts
@@ -5,7 +5,7 @@ jest.mock('@/lib/config.server', () => ({
   WEBHOOK_AGENT_URL: 'https://webhook-agent.test',
 }));
 
-import { createWorkerTrigger, updateWorkerTrigger } from './webhook-agent-client';
+import { createWorkerTrigger, getWorkerTrigger, updateWorkerTrigger } from './webhook-agent-client';
 
 describe('webhook agent client variant forwarding', () => {
   afterEach(() => {
@@ -109,3 +109,69 @@ describe('webhook agent client variant forwarding', () => {
     expect(JSON.parse(String(fetchSpy.mock.calls[0]?.[1]?.body))).toEqual({ variant });
   });
 });
+
+describe('webhook agent client sandbox allocation forwarding', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('serializes omitted, configured, and cleared allocation values', async () => {
+    const fetchSpy = jest.spyOn(global, 'fetch').mockImplementation(
+      async () =>
+        new Response(
+          JSON.stringify({ data: { triggerId: 'trigger', inboundUrl: 'https://inbound' } }),
+          {
+            status: 200,
+          }
+        )
+    );
+
+    await createWorkerTrigger('user-1', undefined, 'trigger', { promptTemplate: 'Run task' });
+    await createWorkerTrigger('user-1', undefined, 'trigger', {
+      promptTemplate: 'Run task',
+      sandboxAllocation: 'isolated-standard',
+    });
+    await updateWorkerTrigger('user-1', undefined, 'trigger', { sandboxAllocation: null });
+
+    expect(JSON.parse(String(fetchSpy.mock.calls[0]?.[1]?.body))).not.toHaveProperty(
+      'sandboxAllocation'
+    );
+    expect(JSON.parse(String(fetchSpy.mock.calls[1]?.[1]?.body))).toMatchObject({
+      sandboxAllocation: 'isolated-standard',
+    });
+    expect(JSON.parse(String(fetchSpy.mock.calls[2]?.[1]?.body))).toEqual({
+      sandboxAllocation: null,
+    });
+  });
+
+  it('returns sandbox allocation from worker configuration responses', async () => {
+    jest.spyOn(global, 'fetch').mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          data: {
+            triggerId: 'trigger',
+            namespace: 'user/user-1',
+            userId: 'user-1',
+            orgId: null,
+            createdAt: '2026-01-01T00:00:00.000Z',
+            isActive: true,
+            targetType: 'cloud_agent',
+            githubRepo: 'owner/repo',
+            mode: 'code',
+            model: 'model',
+            promptTemplate: 'Run task',
+            webhookAuthConfigured: false,
+            activationMode: 'webhook',
+            sandboxAllocation: 'isolated-standard',
+          },
+        }),
+        { status: 200 }
+      )
+    );
+
+    await expect(getWorkerTrigger('user-1', undefined, 'trigger')).resolves.toMatchObject({
+      found: true,
+      config: { sandboxAllocation: 'isolated-standard' },
+    });
+  });
+});
diff --git a/apps/web/src/lib/webhook-agent/webhook-agent-client.ts b/apps/web/src/lib/webhook-agent/webhook-agent-client.ts
index 0d0c906057..44518c7cbc 100644
--- a/apps/web/src/lib/webhook-agent/webhook-agent-client.ts
+++ b/apps/web/src/lib/webhook-agent/webhook-agent-client.ts
@@ -18,6 +18,7 @@ export type TriggerConfigResponse = {
   mode: string | null;
   model: string | null;
   variant?: string | null;
+  sandboxAllocation?: 'isolated-standard';
   promptTemplate: string;
   profileId?: string | null;
   autoCommit?: boolean;
@@ -42,6 +43,7 @@ export type CreateTriggerInput = {
   mode?: string;
   model?: string;
   variant?: string;
+  sandboxAllocation?: 'isolated-standard';
   promptTemplate: string;
   profileId?: string;
   autoCommit?: boolean;
@@ -64,6 +66,7 @@ export type UpdateTriggerInput = {
   mode?: string;
   model?: string;
   variant?: string | null;
+  sandboxAllocation?: 'isolated-standard' | null;
   promptTemplate?: string;
   isActive?: boolean;
   profileId?: string;
diff --git a/apps/web/src/routers/webhook-triggers-router.schema.test.ts b/apps/web/src/routers/webhook-triggers-router.schema.test.ts
index 8c67a6422a..9310e95d07 100644
--- a/apps/web/src/routers/webhook-triggers-router.schema.test.ts
+++ b/apps/web/src/routers/webhook-triggers-router.schema.test.ts
@@ -1,6 +1,8 @@
 import { beforeAll, beforeEach, describe, expect, it, jest } from '@jest/globals';
+import { TRPCError } from '@trpc/server';
 import { createCallerFactory } from '@/lib/trpc/init';
 import type { User } from '@kilocode/db/schema';
+import type { ensureOrganizationAccess } from '@/routers/organizations/utils';
 import type {
   createWorkerTrigger as createWorkerTriggerType,
   updateWorkerTrigger as updateWorkerTriggerType,
@@ -12,13 +14,18 @@ import type {
   webhookTriggersRouter as webhookTriggersRouterType,
 } from './webhook-triggers-router';
 
+const mockEnsureOrganizationAccess = jest.fn<typeof ensureOrganizationAccess>();
+
 const mockCreateWorkerTrigger = jest.fn<typeof createWorkerTriggerType>();
 const mockUpdateWorkerTrigger = jest.fn<typeof updateWorkerTriggerType>();
+const mockDbInsert = jest.fn();
+const mockDbUpdate = jest.fn();
 const mockSelectWhere = jest.fn<
   () => Promise<
     Array<{
       id: string;
       activation_mode: string;
+      target_type: 'cloud_agent' | 'kiloclaw_chat';
     }>
   >
 >();
@@ -30,7 +37,7 @@ jest.mock('@/lib/drizzle', () => ({
         where: mockSelectWhere,
       }),
     }),
-    insert: () => ({
+    insert: mockDbInsert.mockImplementation(() => ({
       values: () => ({
         returning: () =>
           Promise.resolve([
@@ -40,8 +47,10 @@ jest.mock('@/lib/drizzle', () => ({
             },
           ]),
       }),
-    }),
-    update: () => ({ set: () => ({ where: () => Promise.resolve() }) }),
+    })),
+    update: mockDbUpdate.mockImplementation(() => ({
+      set: () => ({ where: () => Promise.resolve() }),
+    })),
   },
 }));
 
@@ -51,6 +60,10 @@ jest.mock('@/lib/webhook-agent/webhook-agent-client', () => ({
   updateWorkerTrigger: mockUpdateWorkerTrigger,
 }));
 
+jest.mock('@/routers/organizations/utils', () => ({
+  ensureOrganizationAccess: mockEnsureOrganizationAccess,
+}));
+
 let createCaller: ReturnType<
   typeof createCallerFactory<typeof webhookTriggersRouterType._def.record>
 >;
@@ -96,10 +109,12 @@ describe('webhook trigger variant inputs', () => {
       {
         id: '00000000-0000-4000-8000-000000000002',
         activation_mode: 'webhook',
+        target_type: 'cloud_agent',
       },
     ]);
     mockCreateWorkerTrigger.mockResolvedValue({ success: true, inboundUrl: 'https://inbound' });
     mockUpdateWorkerTrigger.mockResolvedValue({ success: true, config: triggerConfig });
+    mockEnsureOrganizationAccess.mockResolvedValue('owner');
   });
 
   it.each(['high', 'High', 'a'.repeat(50)])('accepts valid create variant %s', variant => {
@@ -189,4 +204,226 @@ describe('webhook trigger variant inputs', () => {
       expect.objectContaining({ variant: null })
     );
   });
+
+  it.each(['standard', '', null])(
+    'rejects invalid create sandbox allocation %s',
+    sandboxAllocation => {
+      expect(
+        WebhookTriggerCreateInput.safeParse({ ...createInput, sandboxAllocation }).success
+      ).toBe(false);
+    }
+  );
+
+  it('rejects sandbox allocation for KiloClaw creates', () => {
+    expect(
+      WebhookTriggerCreateInput.safeParse({
+        triggerId: 'trigger-id',
+        targetType: 'kiloclaw_chat',
+        kiloclawInstanceId: '00000000-0000-4000-8000-000000000004',
+        promptTemplate: 'Run task',
+        sandboxAllocation: 'isolated-standard',
+      }).success
+    ).toBe(false);
+  });
+
+  it.each(['standard', 'isolated', ''])(
+    'rejects invalid update sandbox allocation %s',
+    sandboxAllocation => {
+      expect(
+        WebhookTriggerUpdateInput.safeParse({ triggerId: 'trigger-id', sandboxAllocation }).success
+      ).toBe(false);
+    }
+  );
+
+  it.each(['owner', 'admin', 'member'] as const)(
+    'reports actual platform-admin capability for an organization %s',
+    async role => {
+      const organizationId = '00000000-0000-4000-8000-000000000003';
+      mockEnsureOrganizationAccess.mockResolvedValueOnce(role);
+      await expect(createCaller({ user }).capabilities({ organizationId })).resolves.toEqual({
+        canSetSandboxAllocation: false,
+      });
+      expect(mockEnsureOrganizationAccess).toHaveBeenCalledWith(expect.anything(), organizationId);
+    }
+  );
+
+  it('reports platform-admin capability and preserves organization access checks', async () => {
+    await expect(createCaller({ user }).capabilities({})).resolves.toEqual({
+      canSetSandboxAllocation: false,
+    });
+    await expect(
+      createCaller({ user: { ...user, is_admin: true } }).capabilities({})
+    ).resolves.toEqual({ canSetSandboxAllocation: true });
+
+    const organizationId = '00000000-0000-4000-8000-000000000003';
+    mockEnsureOrganizationAccess.mockRejectedValueOnce(new TRPCError({ code: 'UNAUTHORIZED' }));
+    await expect(createCaller({ user }).capabilities({ organizationId })).rejects.toMatchObject({
+      code: 'UNAUTHORIZED',
+    });
+  });
+
+  it.each([
+    { scope: 'personal', activationMode: 'webhook', organizationId: undefined },
+    {
+      scope: 'organization',
+      activationMode: 'webhook',
+      organizationId: '00000000-0000-4000-8000-000000000003',
+    },
+    { scope: 'personal', activationMode: 'scheduled', organizationId: undefined },
+    {
+      scope: 'organization',
+      activationMode: 'scheduled',
+      organizationId: '00000000-0000-4000-8000-000000000003',
+    },
+  ] as const)(
+    'allows a Kilo admin to create and update Dedicated Standard for $scope $activationMode triggers',
+    async ({ activationMode, organizationId }) => {
+      const admin = { ...user, is_admin: true };
+      const triggerInput = {
+        ...createInput,
+        ...(organizationId ? { organizationId } : {}),
+        activationMode,
+        ...(activationMode === 'scheduled' ? { cronExpression: '* * * * *' } : {}),
+        sandboxAllocation: 'isolated-standard' as const,
+      };
+      await createCaller({ user: admin }).create(triggerInput);
+      expect(mockCreateWorkerTrigger).toHaveBeenCalledWith(
+        organizationId ? undefined : 'user-1',
+        organizationId,
+        'trigger-id',
+        expect.objectContaining({ sandboxAllocation: 'isolated-standard' })
+      );
+
+      mockSelectWhere.mockResolvedValueOnce([
+        {
+          id: '00000000-0000-4000-8000-000000000002',
+          activation_mode: activationMode,
+          target_type: 'cloud_agent',
+        },
+      ]);
+      await createCaller({ user: admin }).update({
+        triggerId: 'trigger-id',
+        ...(organizationId ? { organizationId } : {}),
+        sandboxAllocation: 'isolated-standard',
+      });
+      expect(mockUpdateWorkerTrigger).toHaveBeenCalledWith(
+        organizationId ? undefined : 'user-1',
+        organizationId,
+        'trigger-id',
+        expect.objectContaining({ sandboxAllocation: 'isolated-standard' })
+      );
+    }
+  );
+
+  it.each([
+    { activationMode: 'webhook', organizationId: undefined },
+    { activationMode: 'scheduled', organizationId: '00000000-0000-4000-8000-000000000003' },
+  ] as const)(
+    'allows a non-admin to clear and preserve omission for $activationMode triggers',
+    async ({ activationMode, organizationId }) => {
+      mockSelectWhere.mockResolvedValueOnce([
+        {
+          id: '00000000-0000-4000-8000-000000000002',
+          activation_mode: activationMode,
+          target_type: 'cloud_agent',
+        },
+      ]);
+      await createCaller({ user }).update({
+        triggerId: 'trigger-id',
+        ...(organizationId ? { organizationId } : {}),
+        sandboxAllocation: null,
+      });
+      expect(mockUpdateWorkerTrigger).toHaveBeenLastCalledWith(
+        organizationId ? undefined : 'user-1',
+        organizationId,
+        'trigger-id',
+        expect.objectContaining({ sandboxAllocation: null })
+      );
+
+      await createCaller({ user }).update({
+        triggerId: 'trigger-id',
+        ...(organizationId ? { organizationId } : {}),
+        isActive: false,
+      });
+      expect(mockUpdateWorkerTrigger).toHaveBeenLastCalledWith(
+        organizationId ? undefined : 'user-1',
+        organizationId,
+        'trigger-id',
+        expect.objectContaining({ sandboxAllocation: undefined })
+      );
+    }
+  );
+
+  it.each(['webhook', 'scheduled'] as const)(
+    'rejects a non-admin Dedicated Standard create and update for %s triggers before writes',
+    async activationMode => {
+      const input = {
+        ...createInput,
+        activationMode,
+        ...(activationMode === 'scheduled' ? { cronExpression: '* * * * *' } : {}),
+        sandboxAllocation: 'isolated-standard' as const,
+      };
+      await expect(createCaller({ user }).create(input)).rejects.toMatchObject({
+        code: 'FORBIDDEN',
+        message: 'Kilo admin access is required to select Dedicated Standard',
+      });
+      await expect(
+        createCaller({ user }).update({
+          triggerId: 'trigger-id',
+          sandboxAllocation: 'isolated-standard',
+        })
+      ).rejects.toMatchObject({
+        code: 'FORBIDDEN',
+        message: 'Kilo admin access is required to select Dedicated Standard',
+      });
+      expect(mockDbInsert).not.toHaveBeenCalled();
+      expect(mockDbUpdate).not.toHaveBeenCalled();
+      expect(mockCreateWorkerTrigger).not.toHaveBeenCalled();
+      expect(mockUpdateWorkerTrigger).not.toHaveBeenCalled();
+    }
+  );
+
+  it('does not grant allocation privileges to an organization owner or member', async () => {
+    const organizationId = '00000000-0000-4000-8000-000000000003';
+    for (const role of ['owner', 'member'] as const) {
+      mockEnsureOrganizationAccess.mockResolvedValueOnce(role);
+      await expect(
+        createCaller({ user }).create({
+          ...createInput,
+          organizationId,
+          sandboxAllocation: 'isolated-standard',
+        })
+      ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    }
+    expect(mockCreateWorkerTrigger).not.toHaveBeenCalled();
+  });
+
+  it.each([null, 'isolated-standard'] as const)(
+    'rejects stored KiloClaw allocation update %s even with a forged cloud-agent target',
+    async sandboxAllocation => {
+      mockSelectWhere.mockResolvedValueOnce([
+        {
+          id: '00000000-0000-4000-8000-000000000002',
+          activation_mode: 'webhook',
+          target_type: 'kiloclaw_chat',
+        },
+      ]);
+      const forgedInput = { triggerId: 'trigger-id', sandboxAllocation, targetType: 'cloud_agent' };
+      await expect(
+        createCaller({ user: { ...user, is_admin: true } }).update(forgedInput)
+      ).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+      expect(mockUpdateWorkerTrigger).not.toHaveBeenCalled();
+    }
+  );
+
+  it('returns not found for an unknown trigger before contacting the worker', async () => {
+    mockSelectWhere.mockResolvedValueOnce([]);
+    await expect(
+      createCaller({ user }).update({
+        triggerId: 'trigger-id',
+        sandboxAllocation: 'isolated-standard',
+      })
+    ).rejects.toMatchObject({ code: 'NOT_FOUND' });
+    expect(mockUpdateWorkerTrigger).not.toHaveBeenCalled();
+  });
 });
diff --git a/apps/web/src/routers/webhook-triggers-router.ts b/apps/web/src/routers/webhook-triggers-router.ts
index 9cdfb78ecc..cabb83b412 100644
--- a/apps/web/src/routers/webhook-triggers-router.ts
+++ b/apps/web/src/routers/webhook-triggers-router.ts
@@ -44,6 +44,7 @@ export const WebhookTriggerCreateInput = z
     mode: z.enum(['architect', 'code', 'ask', 'debug', 'orchestrator']).optional(),
     model: z.string().min(1, 'Model is required').optional(),
     variant: variantSchema.optional(),
+    sandboxAllocation: z.literal('isolated-standard').optional(),
     profileId: z.string().uuid().optional(),
     // Shared fields
     promptTemplate: z
@@ -118,6 +119,13 @@ export const WebhookTriggerCreateInput = z
           message: 'KiloClaw instance is required',
           path: ['kiloclawInstanceId'],
         });
+      if (data.sandboxAllocation !== undefined) {
+        ctx.addIssue({
+          code: 'custom',
+          message: 'Sandbox allocation is not applicable for KiloClaw Chat triggers',
+          path: ['sandboxAllocation'],
+        });
+      }
     }
   });
 
@@ -130,6 +138,7 @@ export const WebhookTriggerUpdateInput = z
     mode: z.enum(['architect', 'code', 'ask', 'debug', 'orchestrator']).optional(),
     model: z.string().min(1).optional(),
     variant: variantSchema.nullable().optional(),
+    sandboxAllocation: z.literal('isolated-standard').nullable().optional(),
     promptTemplate: z.string().min(1).max(10000).optional(),
     profileId: z.string().uuid().optional(),
     autoCommit: z.boolean().nullable().optional(),
@@ -260,6 +269,15 @@ async function assertProfileOwnership(
 }
 
 export const webhookTriggersRouter = createTRPCRouter({
+  capabilities: baseProcedure
+    .input(z.object({ organizationId: z.string().uuid().optional() }))
+    .query(async ({ ctx, input }) => {
+      if (input.organizationId) {
+        await ensureOrganizationAccess(ctx, input.organizationId);
+      }
+      return { canSetSandboxAllocation: ctx.user.is_admin };
+    }),
+
   /**
    * List triggers for current user or organization.
    * Reads from PostgreSQL only (can't enumerate DOs).
@@ -398,6 +416,13 @@ export const webhookTriggersRouter = createTRPCRouter({
       await ensureOrganizationAccess(ctx, input.organizationId, ['owner', 'member']);
     }
 
+    if (input.sandboxAllocation === 'isolated-standard' && !ctx.user.is_admin) {
+      throw new TRPCError({
+        code: 'FORBIDDEN',
+        message: 'Kilo admin access is required to select Dedicated Standard',
+      });
+    }
+
     // KiloClaw Chat triggers are personal only — org-scoped triggers would fail at delivery
     if (input.targetType === 'kiloclaw_chat' && input.organizationId) {
       throw new TRPCError({
@@ -486,6 +511,7 @@ export const webhookTriggersRouter = createTRPCRouter({
           mode: input.mode,
           model: input.model,
           variant: input.variant,
+          sandboxAllocation: input.sandboxAllocation,
           promptTemplate: input.promptTemplate,
           profileId: input.profileId,
           autoCommit: input.autoCommit,
@@ -568,6 +594,20 @@ export const webhookTriggersRouter = createTRPCRouter({
     // Verify ownership via PostgreSQL
     const dbTrigger = await assertTriggerOwnership(userId, input.triggerId, input.organizationId);
 
+    if (input.sandboxAllocation !== undefined && dbTrigger.target_type === 'kiloclaw_chat') {
+      throw new TRPCError({
+        code: 'BAD_REQUEST',
+        message: 'Sandbox allocation is not applicable for KiloClaw Chat triggers',
+      });
+    }
+
+    if (input.sandboxAllocation === 'isolated-standard' && !ctx.user.is_admin) {
+      throw new TRPCError({
+        code: 'FORBIDDEN',
+        message: 'Kilo admin access is required to select Dedicated Standard',
+      });
+    }
+
     // Validate profile ownership if profileId provided
     if (input.profileId) {
       await assertProfileOwnership(userId, input.organizationId, input.profileId);
@@ -577,6 +617,7 @@ export const webhookTriggersRouter = createTRPCRouter({
       input.mode,
       input.model,
       input.variant,
+      input.sandboxAllocation,
       input.promptTemplate,
       input.profileId,
       input.autoCommit,
@@ -602,6 +643,7 @@ export const webhookTriggersRouter = createTRPCRouter({
       mode: input.mode,
       model: input.model,
       variant: input.variant,
+      sandboxAllocation: input.sandboxAllocation,
       promptTemplate: input.promptTemplate,
       isActive: input.isActive,
       profileId: input.profileId,
diff --git a/docs/pr-assets/trigger-dedicated-standard.png b/docs/pr-assets/trigger-dedicated-standard.png
new file mode 100644
index 0000000000..f2923205b0
Binary files /dev/null and b/docs/pr-assets/trigger-dedicated-standard.png differ