diff --git a/crates/openshell-server/src/grpc/policy.rs b/crates/openshell-server/src/grpc/policy.rs
index f78bbf413f..1d942e4a3f 100644
--- a/crates/openshell-server/src/grpc/policy.rs
+++ b/crates/openshell-server/src/grpc/policy.rs
@@ -2234,6 +2234,7 @@ async fn handle_update_config_inner(
         })?
     };
     response_annotations = committed_annotations;
+    state.sandbox_watch_bus.notify(&sandbox_id);
 
     if backfill_policy.is_some() {
         info!(
@@ -12517,6 +12518,7 @@ mod tests {
             )
             .await
             .unwrap();
+        let mut watch_rx = state.sandbox_watch_bus.subscribe("sb-same-hash");
 
         let response = handle_update_config(
             &state,
@@ -12535,6 +12537,16 @@ mod tests {
         .into_inner();
 
         assert_eq!(response.version, 2);
+        watch_rx
+            .try_recv()
+            .expect("new provenance revision must notify the sandbox watcher");
+        assert!(
+            matches!(
+                watch_rx.try_recv(),
+                Err(tokio::sync::broadcast::error::TryRecvError::Empty)
+            ),
+            "one committed revision must wake the sandbox watcher exactly once"
+        );
         assert_eq!(
             response
                 .annotations