diff --git a/CHANGELOG.md b/CHANGELOG.md
index f86c0a46a5..2a78ce3b30 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -256,6 +256,14 @@ file is the human-readable summary of what changed and why.
 
 ### Sandbox
 
+- **Sandbox distros no longer pose as WSL server candidates** — the
+  "Add WSL server" dialog listed every installed distribution, including the
+  `codev-*` distros the sandbox creates for itself, each marked "CoDev not
+  installed" with an Install CoDev button. Installing into one would be
+  wrong — a sandbox guest is a minimal image that gets the server mounted in
+  at boot and is owned by the sandbox lifecycle, not a distro of yours. The
+  dialog now hides the sandbox's reserved `codev-` namespace the same way it
+  already hides Docker Desktop's infrastructure distros.
 - **A Windows sandbox starts again after WSL updates itself** — when WSL
   installed an update while its VM was still running (Docker Desktop or another
   distro keeps it alive), starting a sandbox failed with a cryptic nftables
diff --git a/packages/app/src/wsl/settings-model.test.ts b/packages/app/src/wsl/settings-model.test.ts
index e68ff8231d..dfd77987c3 100644
--- a/packages/app/src/wsl/settings-model.test.ts
+++ b/packages/app/src/wsl/settings-model.test.ts
@@ -138,6 +138,29 @@ describe("WSL server settings presentation", () => {
     expect(gate.accepts("addable:distro:Debian")).toBe(true)
   })
 
+  test("hides infrastructure and sandbox distros from the add dialog", () => {
+    const model = addServerViewModel({
+      state: readyState({
+        installed: [
+          { name: "docker-desktop", version: 2, isDefault: false },
+          { name: "docker-desktop-data", version: 2, isDefault: false },
+          { name: "codev-default-sandbox", version: 2, isDefault: false },
+          { name: "codev-my-project-1", version: 2, isDefault: false },
+          { name: "Ubuntu", version: 2, isDefault: true },
+        ],
+      }),
+      view: "main",
+      selectedDistro: null,
+      catalogSearch: "",
+      catalogTarget: null,
+      adding: false,
+      probingAddable: false,
+    })
+    expect(model.visibleInstalledDistros.map((item) => item.name)).toEqual(["Ubuntu"])
+    expect(model.addableInstalledDistros.map((item) => item.name)).toEqual(["Ubuntu"])
+    expect(model.selectedDistro).toBe("Ubuntu")
+  })
+
   test("keeps default distro selection stable while probes resolve", () => {
     const model = addServerViewModel({
       state: {
diff --git a/packages/app/src/wsl/settings-model.ts b/packages/app/src/wsl/settings-model.ts
index c794e54ff8..9a739f6fe9 100644
--- a/packages/app/src/wsl/settings-model.ts
+++ b/packages/app/src/wsl/settings-model.ts
@@ -45,7 +45,12 @@ export type AddServerProbePlan =
 export type WslAddServerView = "main" | "catalog"
 
 function isHiddenDistro(name: string) {
-  return /^docker-desktop(?:-data)?$/i.test(name)
+  // docker-desktop is Docker's infrastructure; codev- is the sandbox
+  // provider's reserved namespace (wslDistroName prefixes every sandbox
+  // distro with it). Neither is a WSL-server candidate: sandbox guests are
+  // minimal images that get the server bundle bind-mounted at boot and are
+  // owned by the sandbox lifecycle.
+  return /^docker-desktop(?:-data)?$/i.test(name) || /^codev-/i.test(name)
 }
 
 export const wslRuntimeRetryable = (runtime: WslServerRuntime) =>