diff --git a/core/core.services.yml b/core/core.services.yml
index 9bf8562..3b32c6a 100644
--- a/core/core.services.yml
+++ b/core/core.services.yml
@@ -8,6 +8,9 @@ parameters:
     debug: false
     auto_reload: null
     cache: true
+    extensions:
+      sandbox:
+        global: true
   renderer.config:
     required_cache_contexts: ['languages:language_interface', 'theme', 'user.permissions']
     auto_placeholder_conditions:
diff --git a/core/lib/Drupal/Core/Template/TwigEnvironment.php b/core/lib/Drupal/Core/Template/TwigEnvironment.php
index 3a3d002..fce6e2f 100644
--- a/core/lib/Drupal/Core/Template/TwigEnvironment.php
+++ b/core/lib/Drupal/Core/Template/TwigEnvironment.php
@@ -48,18 +48,20 @@ public function __construct($root, CacheBackendInterface $cache, $twig_extension
     require_once $root . '/core/themes/engines/twig/twig.engine';
 
     $this->templateClasses = array();
-
     $options += array(
       // @todo Ensure garbage collection of expired files.
       'cache' => TRUE,
       'debug' => FALSE,
       'auto_reload' => NULL,
+      'extensions' => array(
+        'sandbox' => array('global' => TRUE),
+      ),
     );
     // Ensure autoescaping is always on.
     $options['autoescape'] = 'html';
 
     $policy = new TwigSandboxPolicy();
-    $sandbox = new \Twig_Extension_Sandbox($policy, TRUE);
+    $sandbox = new \Twig_Extension_Sandbox($policy, $options['extensions']['sandbox']['global']);
     $this->addExtension($sandbox);
 
     if ($options['cache'] === TRUE) {