diff --git a/3rd_party/CMakeLists.txt b/3rd_party/CMakeLists.txt
index 5d1c612f4e..0a14060894 100644
--- a/3rd_party/CMakeLists.txt
+++ b/3rd_party/CMakeLists.txt
@@ -62,6 +62,17 @@ if (CMAKE_SYSTEM_NAME STREQUAL "Linux")
   set(_saved_CMAKE_UNITY_BUILD ${CMAKE_UNITY_BUILD})
   set(CMAKE_UNITY_BUILD OFF)
 
+  # The top-level build applies ml-cpp's strict warning set (including
+  # -Wconversion, see cmake/compiler/*.cmake) to every target via
+  # add_compile_options(${ML_CXX_FLAGS}), and the debug Linux CI build sets
+  # CMAKE_COMPILE_WARNING_AS_ERROR=ON. Both are inherited by any vendored
+  # third-party sources compiled in this block, whose own diagnostics we do
+  # not control and should not gate our build on. Keep the warnings visible
+  # but non-fatal for this third-party subtree only; ml-cpp's own targets are
+  # unaffected and continue to treat warnings as errors.
+  set(_saved_CMAKE_COMPILE_WARNING_AS_ERROR ${CMAKE_COMPILE_WARNING_AS_ERROR})
+  set(CMAKE_COMPILE_WARNING_AS_ERROR OFF)
+
   set(ABSL_PROPAGATE_CXX_STD ON CACHE INTERNAL "" FORCE)
   set(ABSL_USE_EXTERNAL_GOOGLETEST OFF CACHE INTERNAL "" FORCE)
   set(ABSL_FIND_GOOGLETEST OFF CACHE INTERNAL "" FORCE)
@@ -156,4 +167,5 @@ if (CMAKE_SYSTEM_NAME STREQUAL "Linux")
   set(BUILD_TESTING ${_saved_BUILD_TESTING} CACHE BOOL "" FORCE)
   set(BUILD_SHARED_LIBS ${_saved_BUILD_SHARED_LIBS} CACHE BOOL "" FORCE)
   set(CMAKE_UNITY_BUILD ${_saved_CMAKE_UNITY_BUILD})
+  set(CMAKE_COMPILE_WARNING_AS_ERROR ${_saved_CMAKE_COMPILE_WARNING_AS_ERROR})
 endif()
diff --git a/lib/sandbox/CMakeLists.txt b/lib/sandbox/CMakeLists.txt
index 89170eb66a..5bf3b6d0d6 100644
--- a/lib/sandbox/CMakeLists.txt
+++ b/lib/sandbox/CMakeLists.txt
@@ -42,6 +42,15 @@ if(TARGET sandbox2::sandbox2)
     # against the alias name from outside this cache variable.
     target_link_libraries(MlSandbox PUBLIC sandbox2::sandbox2)
     target_link_libraries(MlSandbox PUBLIC "-Wl,--no-as-needed,-lz,--as-needed")
+    # The Sandbox2/Abseil/protobuf headers are pulled in as normal (-I)
+    # includes - deliberately not -isystem, so they stay ahead of PyTorch's
+    # bundled protobuf in the search path - and are not warning-clean under
+    # ml-cpp's strict flags (-Wconversion, -Wunused-parameter, ...). Under the
+    # debug CI build's CMAKE_COMPILE_WARNING_AS_ERROR=ON those header warnings
+    # would fail this target's compilation. Keep them visible but non-fatal
+    # for MlSandbox only; every other ml-cpp target still treats warnings as
+    # errors.
+    set_target_properties(MlSandbox PROPERTIES COMPILE_WARNING_AS_ERROR OFF)
     message(STATUS "MlSandbox: Sandbox2 enabled and linked")
   endif()
 else()
diff --git a/lib/sandbox/unittest/CMakeLists.txt b/lib/sandbox/unittest/CMakeLists.txt
index c0ad8e0a02..d2d8fcb17a 100644
--- a/lib/sandbox/unittest/CMakeLists.txt
+++ b/lib/sandbox/unittest/CMakeLists.txt
@@ -77,6 +77,15 @@ endif()
 
 ml_add_test_executable(sandbox ${SRCS})
 
+if(TARGET sandbox2::sandbox2 AND CMAKE_SYSTEM_NAME STREQUAL "Linux")
+  # This test target includes Sandbox2/Abseil/protobuf headers, which are not
+  # warning-clean under ml-cpp's strict flags. Under the debug CI build's
+  # CMAKE_COMPILE_WARNING_AS_ERROR=ON those header warnings would fail the
+  # build. Keep them visible but non-fatal for this target only; see the
+  # matching note on MlSandbox in ../CMakeLists.txt.
+  set_target_properties(ml_test_sandbox PROPERTIES COMPILE_WARNING_AS_ERROR OFF)
+endif()
+
 if(TARGET sandbox2_smoke_payload)
   add_dependencies(ml_test_sandbox sandbox2_smoke_payload)
   target_compile_definitions(ml_test_sandbox PRIVATE