diff --git a/packages/cli/src/utils/sandbox.ts b/packages/cli/src/utils/sandbox.ts
index a08ed7e1..a76ad736 100644
--- a/packages/cli/src/utils/sandbox.ts
+++ b/packages/cli/src/utils/sandbox.ts
@@ -231,6 +231,28 @@ export async function start_sandbox(sandbox: string) {
     }
   }
 
+  // if VIRTUAL_ENV is set, require that it is workdir/.venv
+  // then mount-replace it with sandbox.venv under project settings directory
+  // this helps avoid host binaries in sandbox and lets uv work seamlessly w/o requiring --active flag
+  // sandbox must be ready to set up an empty .venv directory via sandbox.{Dockerfile,bashrc}
+  if (process.env.VIRTUAL_ENV) {
+    const workdirVenvPath = path.join(workdir, '.venv');
+    if (workdirVenvPath !== process.env.VIRTUAL_ENV) {
+      console.error(
+        `ERROR: VIRTUAL_ENV '${process.env.VIRTUAL_ENV}' is not supported; should be ${workdirVenvPath}`,
+      );
+      process.exit(1);
+    }
+    const sandboxVenvPath = path.resolve(
+      SETTINGS_DIRECTORY_NAME,
+      'sandbox.venv',
+    );
+    if (!fs.existsSync(sandboxVenvPath)) {
+      fs.mkdirSync(sandboxVenvPath, { recursive: true });
+    }
+    args.push('--volume', `${sandboxVenvPath}:${workdirVenvPath}`);
+  }
+
   // copy additional environment variables from SANDBOX_ENV
   if (process.env.SANDBOX_ENV) {
     for (let env of process.env.SANDBOX_ENV.split(',')) {