diff --git a/abstractions/3rd/file-chooser b/abstractions/3rd/file-chooser
index 5b866ee..20d779c 100644
--- a/abstractions/3rd/file-chooser
+++ b/abstractions/3rd/file-chooser
@@ -2,6 +2,7 @@
 
   #include <abstractions/dbus-strict>
   #include <abstractions/3rd/nameservice-strict>
+#  #include <abstractions/nameservice>   # embedded, but more relaxed
 
   # list directory contents
   / r,
diff --git a/usr.bin.curl b/usr.bin.curl
index 1626f5c..9872439 100644
--- a/usr.bin.curl
+++ b/usr.bin.curl
@@ -7,6 +7,7 @@ profile curl /usr/bin/curl {
   #include <abstractions/base>
   #include <abstractions/openssl>
   #include <abstractions/ssl_certs>
+#  #include <abstractions/nameservice>   # embedded, but more relaxed
   #include <abstractions/3rd/nameservice-strict>
 
   owner @{HOME}/.curlrc r,
diff --git a/usr.bin.ristretto b/usr.bin.ristretto
index 4484e28..508409c 100644
--- a/usr.bin.ristretto
+++ b/usr.bin.ristretto
@@ -147,6 +147,8 @@ profile ristretto//dash {
   /{,usr/}bin/dash r,
   #include <abstractions/base>
   #include <abstractions/ubuntu-helpers>
+  #include <abstractions/private-files>
+  #include <abstractions/private-files-strict>
 
   # sanitized, slightly less bad than Ux; "Use at your own risk."
   /usr/bin/gimp-[2-3].[0-9]{,[0-9]} Cx -> sanitized_helper,
diff --git a/usr.sbin.openvpn b/usr.sbin.openvpn
index ddeff83..7cf19df 100644
--- a/usr.sbin.openvpn
+++ b/usr.sbin.openvpn
@@ -5,6 +5,7 @@
 profile openvpn /usr/sbin/openvpn {
   #include <abstractions/base>
   #include <abstractions/openssl>
+#  #include <abstractions/nameservice>   # embedded, but more relaxed
   #include <abstractions/3rd/nameservice-strict>
 
   capability net_admin,