diff --git a/package.json b/package.json
index 1e76e0b54..7c5d04a27 100644
--- a/package.json
+++ b/package.json
@@ -33,7 +33,7 @@
     "compliance:audit": "bash ./scripts/yarn-audit.sh",
     "precommit": "yarn compliance:licenses && yarn compliance:audit && yarn lint && yarn test",
     "commit": "git-cz",
-    "compliance:licenses": "license-checker --onlyAllow 'Apache*;Apache License, Version 2.0;Apache-2.0;Apache 2.0;Artistic-2.0;BSD;BSD-3-Clause;CC-BY-3.0;CC-BY-4.0;CC0-1.0;ISC;MIT;MPL-2.0;Public Domain;Unicode-TOU;Unlicense;WTFPL' --excludePackages 'boundary-ui;admin@0.0.0;desktop@0.0.0;base64-js@0.0.2'",
+    "compliance:licenses": "license-checker --onlyAllow 'Apache*;Apache License, Version 2.0;Apache-2.0;Apache 2.0;Artistic-2.0;BSD;BSD-3-Clause;CC-BY-3.0;CC-BY-4.0;CC0-1.0;ISC;MIT;MPL-2.0;Public Domain;Unicode-TOU;Unlicense;WTFPL' --excludePackages 'boundary-ui;admin@0.0.0;desktop@0.0.0;base64-js@0.0.2;cycle@1.0.3'",
     "doc:toc": "doctoc README.md"
   },
   "devDependencies": {
diff --git a/ui/desktop/electron-app/src/index.js b/ui/desktop/electron-app/src/index.js
index 30a525099..a2088505b 100644
--- a/ui/desktop/electron-app/src/index.js
+++ b/ui/desktop/electron-app/src/index.js
@@ -51,6 +51,13 @@ app.on('ready', async () => {
     callback({ path: normalizedPath });
   });
 
+  // Disallow all permissions requests originating outside of serve://boundary,
+  // per Electronegativity PERMISSION_REQUEST_HANDLER_GLOBAL_CHECK
+  ses.setPermissionRequestHandler((webContents, permission, callback) => {
+    if (webContents.getURL().startsWith('serve://boundary')) return callback(false);
+    return callback(true);
+  });
+
   if (isDev) {
     try {
       require('devtron').install();
@@ -77,6 +84,7 @@ app.on('ready', async () => {
       enableRemoteModule: false,
       allowRunningInsecureContent: false,
       preload: preloadPath,
+      disableBlinkFeatures: 'Auxclick'
     },
   });
 
@@ -101,6 +109,16 @@ app.on('ready', async () => {
     );
   });
 
+  // Prevent navigation outside of serve://boundary per
+  // Electronegativity LIMIT_NAVIGATION_GLOBAL_CHECK
+  mainWindow.webContents.on('will-navigate', (event, url) => {
+    if (!url.startsWith('serve://boundary')) event.preventDefault();
+  });
+
+  mainWindow.webContents.on('new-window', (event, url) => {
+    if (!url.startsWith('serve://boundary')) event.preventDefault();
+  });
+
   mainWindow.on('unresponsive', () => {
     console.log(
       'Your Ember app (or other code) has made the window unresponsive.'
diff --git a/ui/desktop/package.json b/ui/desktop/package.json
index d543d6805..58ce6d3d1 100644
--- a/ui/desktop/package.json
+++ b/ui/desktop/package.json
@@ -17,7 +17,7 @@
     "lint:hbs": "ember-template-lint .",
     "lint:js": "eslint .",
     "lint:sass": "stylelint '**/*.scss'",
-    "lint:electron": "electronegativity -i ./electron-app",
+    "lint:electron": "electronegativity -r -i ./electron-app",
     "format": "npm-run-all format:*",
     "format:js": "prettier --write '{app,config,stories,tests,electron-app/src}/**/*.js' *.js",
     "format:sass": "prettier --write app/**/*.scss",