diff --git a/src/main/java/com/google/devtools/build/lib/sandbox/DarwinSandboxedSpawnRunner.java b/src/main/java/com/google/devtools/build/lib/sandbox/DarwinSandboxedSpawnRunner.java
index 2593b1ff3919ea..c7df774611263f 100644
--- a/src/main/java/com/google/devtools/build/lib/sandbox/DarwinSandboxedSpawnRunner.java
+++ b/src/main/java/com/google/devtools/build/lib/sandbox/DarwinSandboxedSpawnRunner.java
@@ -340,7 +340,6 @@ private void writeConfig(
 
       if (!allowNetwork) {
         out.println("(deny network*)");
-        out.println("(allow network* (local ip \"localhost:*\"))");
         out.println("(allow network* (remote ip \"localhost:*\"))");
         out.println("(allow network* (remote unix-socket))");
       }
diff --git a/src/test/shell/bazel/bazel_sandboxing_test.sh b/src/test/shell/bazel/bazel_sandboxing_test.sh
index b61649e3649746..1a7145a6db3901 100755
--- a/src/test/shell/bazel/bazel_sandboxing_test.sh
+++ b/src/test/shell/bazel/bazel_sandboxing_test.sh
@@ -379,12 +379,6 @@ genrule(
 )
 EOF
 
-  # TODO(https://github.com/bazelbuild/bazel/issues/10068): Remove once
-  # network sandboxing works on macOS.
-  case "$(uname -s)" in
-    Darwin) REMOTE_NETWORK_ADDRESS= ;;
-  esac
-
   if [[ -n "${REMOTE_NETWORK_ADDRESS}" ]]; then
     local hostname="${REMOTE_NETWORK_ADDRESS%:*}"
     local remote_ip