diff --git a/src/embed.ts b/src/embed.ts
index ef27eaad..61f24068 100644
--- a/src/embed.ts
+++ b/src/embed.ts
@@ -750,6 +750,17 @@ export abstract class Embed {
       iframeContent.setAttribute("src", embedUrl);
       iframeContent.setAttribute("scrolling", "no");
       iframeContent.setAttribute("allowfullscreen", "true");
+
+      // Sandbox flags and the permissions-policy container are snapshotted when the frame is
+      // inserted, so these must be set before appendChild to affect the document that loads.
+      if (this.config.iframeAllow) {
+        iframeContent.setAttribute("allow", this.config.iframeAllow);
+      }
+
+      if (this.config.iframeSandbox) {
+        iframeContent.setAttribute("sandbox", this.config.iframeSandbox);
+      }
+
       const node = this.element;
       while (node.firstChild) {
         node.removeChild(node.firstChild);