diff --git a/hardening/nixpaks/modules/common.nix b/hardening/nixpaks/modules/common.nix
index f80f8ac5..d23848b2 100644
--- a/hardening/nixpaks/modules/common.nix
+++ b/hardening/nixpaks/modules/common.nix
@@ -205,6 +205,10 @@ in
           xdgCacheHome
         ]
 
+        # FileChooser may return a Document Portal path even for a directly mapped XDG directory;
+        # keep the FUSE mount writable so SaveFile can create the selected file.
+        (sloth.concat' sloth.runtimeDir "/doc")
+
         (sloth.concat [
           sloth.runtimeDir
           "/"
@@ -220,7 +224,6 @@ in
         (sloth.concat' sloth.xdgCacheHome "/radv_builtin_shaders")
       ];
       bind.ro = [
-        (sloth.concat' sloth.runtimeDir "/doc")
         (sloth.concat' sloth.xdgConfigHome "/kdeglobals")
         (sloth.concat' sloth.xdgConfigHome "/gtk-2.0")
         (sloth.concat' sloth.xdgConfigHome "/gtk-3.0")
diff --git a/hardening/nixpaks/modules/gui-base.nix b/hardening/nixpaks/modules/gui-base.nix
index dff87c5f..2090a3ef 100644
--- a/hardening/nixpaks/modules/gui-base.nix
+++ b/hardening/nixpaks/modules/gui-base.nix
@@ -54,7 +54,6 @@ in
         "/run/dbus"
       ];
       bind.ro = [
-        (envSuffix "XDG_RUNTIME_DIR" "/doc")
         (sloth.concat' sloth.xdgConfigHome "/gtk-2.0")
         (sloth.concat' sloth.xdgConfigHome "/gtk-3.0")
         (sloth.concat' sloth.xdgConfigHome "/gtk-4.0")