diff --git a/src/lib/policy/index.ts b/src/lib/policy/index.ts
index 2c7bf1eec54..b2f58fac012 100644
--- a/src/lib/policy/index.ts
+++ b/src/lib/policy/index.ts
@@ -996,6 +996,7 @@ export {
   loadPresetFromFile,
   removePreset,
   applyPermissivePolicy,
+  resolvePermissivePolicyPath,
   getAppliedPresets,
   getGatewayPresets,
   listCustomPresets,
diff --git a/src/lib/shields/index.test.ts b/src/lib/shields/index.test.ts
index 3ec7e5f02aa..633aeb8ce88 100644
--- a/src/lib/shields/index.test.ts
+++ b/src/lib/shields/index.test.ts
@@ -37,6 +37,7 @@ vi.mock("../policy", () => ({
   ]),
   parseCurrentPolicy: vi.fn((raw) => raw || ""),
   PERMISSIVE_POLICY_PATH: "/mock/permissive.yaml",
+  resolvePermissivePolicyPath: vi.fn(() => "/mock/permissive.yaml"),
 }));
 
 vi.mock("../sandbox/config", () => ({
diff --git a/src/lib/shields/index.ts b/src/lib/shields/index.ts
index c21f2890165..c2ba529f6e7 100644
--- a/src/lib/shields/index.ts
+++ b/src/lib/shields/index.ts
@@ -24,7 +24,7 @@ const {
   buildPolicyGetCommand,
   buildPolicySetCommand,
   parseCurrentPolicy,
-  PERMISSIVE_POLICY_PATH,
+  resolvePermissivePolicyPath,
 } = require("../policy");
 const {
   parseDuration,
@@ -909,7 +909,7 @@ function shieldsDown(sandboxName: string, opts: ShieldsDownOpts = {}): void {
   // 2. Determine and apply relaxed policy
   let policyFile: string;
   if (policyName === "permissive") {
-    policyFile = PERMISSIVE_POLICY_PATH;
+    policyFile = resolvePermissivePolicyPath(sandboxName);
   } else if (fs.existsSync(policyName)) {
     policyFile = path.resolve(policyName);
   } else {