diff --git a/ChangeLog b/ChangeLog
index 9bf90758c..0436c32f6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20110904
+ - (djm) [regress/connect-privsep.sh regress/test-exec.sh] demote fatal
+   regress errors for the sandbox to warnings. ok tim dtucker
+
 20110829
  - (djm) [openbsd-compat/port-linux.c] Suppress logging when attempting
    to switch SELinux context away from unconfined_t, based on patch from
diff --git a/regress/connect-privsep.sh b/regress/connect-privsep.sh
index e7f938981..11fb9aef9 100644
--- a/regress/connect-privsep.sh
+++ b/regress/connect-privsep.sh
@@ -19,6 +19,7 @@ echo 'UsePrivilegeSeparation sandbox' >> $OBJ/sshd_proxy
 for p in 1 2; do
 	${SSH} -$p -F $OBJ/ssh_proxy 999.999.999.999 true
 	if [ $? -ne 0 ]; then
-		fail "ssh privsep/sandbox+proxyconnect protocol $p failed"
+		# XXX replace this with fail once sandbox has stabilised
+		warn "ssh privsep/sandbox+proxyconnect protocol $p failed"
 	fi
 done
diff --git a/regress/test-exec.sh b/regress/test-exec.sh
index 5c56aefff..092cfed5b 100644
--- a/regress/test-exec.sh
+++ b/regress/test-exec.sh
@@ -204,6 +204,11 @@ verbose ()
 	fi
 }
 
+warn ()
+{
+	echo "WARNING: $@" >>$TEST_SSH_LOGFILE
+	echo "WARNING: $@"
+}
 
 fail ()
 {