diff --git a/SyntaxHighlight.php b/SyntaxHighlight.php
index f17d5312..d6a476fb 100644
--- a/SyntaxHighlight.php
+++ b/SyntaxHighlight.php
@@ -294,6 +294,7 @@ class SyntaxHighlight {
 				'-O', implode( ',', $optionPairs )
 			)
 				->input( $code )
+				->restrict( Shell::RESTRICT_DEFAULT | Shell::NO_NETWORK )
 				->execute();
 
 			if ( $result->getExitCode() != 0 ) {
diff --git a/maintenance/updateCSS.php b/maintenance/updateCSS.php
index f72a454b..2ec85383 100644
--- a/maintenance/updateCSS.php
+++ b/maintenance/updateCSS.php
@@ -44,7 +44,9 @@ class UpdateCSS extends Maintenance {
 			'-f', 'html',
 			'-S', 'default',
 			'-a', '.' . SyntaxHighlight::HIGHLIGHT_CSS_CLASS
-		)->execute();
+		)
+			->restrict( Shell::RESTRICT_DEFAULT | Shell::NO_NETWORK )
+			->execute();
 
 		if ( $result->getExitCode() != 0 ) {
 			throw new \RuntimeException( $result->getStderr() );
diff --git a/maintenance/updateLexerList.php b/maintenance/updateLexerList.php
index 4e1b2d19..e1f99aee 100644
--- a/maintenance/updateLexerList.php
+++ b/maintenance/updateLexerList.php
@@ -46,7 +46,9 @@ class UpdateLexerList extends Maintenance {
 		$result = Shell::command(
 			SyntaxHighlight::getPygmentizePath(),
 			'-L', 'lexer'
-		)->execute();
+		)
+			->restrict( Shell::RESTRICT_DEFAULT | Shell::NO_NETWORK )
+			->execute();
 
 		if ( $result->getExitCode() != 0 ) {
 			throw new \RuntimeException( $result->getStderr() );