diff --git a/.github/codex/config.toml b/.github/codex/config.toml
new file mode 100644
index 00000000..75098fa2
--- /dev/null
+++ b/.github/codex/config.toml
@@ -0,0 +1,4 @@
+# Trusted by codex-action@v1 (not sanitized by its codex-args validation).
+# Enables network inside the workspace-write sandbox for the agent workflows.
+[sandbox_workspace_write]
+network_access = true
diff --git a/.github/workflows/_sre-agent.yml b/.github/workflows/_sre-agent.yml
index 91d604ce..4ff60b09 100644
--- a/.github/workflows/_sre-agent.yml
+++ b/.github/workflows/_sre-agent.yml
@@ -95,7 +95,7 @@ jobs:
         sandbox: workspace-write
         safety-strategy: drop-sudo
         effort: high
-        codex-args: '--config sandbox_workspace_write.network_access=true'
+        codex-home: ${{ github.workspace }}/.github/codex
         prompt: |
           <instructions>
           ${{ env.AGENT_PROMPT }}
diff --git a/.github/workflows/monitor.yml b/.github/workflows/monitor.yml
index 9f241a9d..b2d5db17 100644
--- a/.github/workflows/monitor.yml
+++ b/.github/workflows/monitor.yml
@@ -570,7 +570,7 @@ jobs:
         sandbox: workspace-write
         safety-strategy: drop-sudo
         effort: high
-        codex-args: '--config sandbox_workspace_write.network_access=true'
+        codex-home: ${{ github.workspace }}/.github/codex
         prompt: |
           <instructions>
           ${{ env.AGENT_PROMPT }}
diff --git a/.github/workflows/product.yml b/.github/workflows/product.yml
index 7077b9c5..4e5a638d 100644
--- a/.github/workflows/product.yml
+++ b/.github/workflows/product.yml
@@ -299,7 +299,7 @@ jobs:
         sandbox: workspace-write
         safety-strategy: drop-sudo
         effort: medium
-        codex-args: '--config sandbox_workspace_write.network_access=true'
+        codex-home: ${{ github.workspace }}/.github/codex
         prompt: |
           <instructions>
           ${{ env.AGENT_PROMPT }}
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index 5a212a20..a56a8105 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -99,7 +99,7 @@ jobs:
         sandbox: workspace-write
         safety-strategy: drop-sudo
         effort: medium
-        codex-args: '--config sandbox_workspace_write.network_access=true'
+        codex-home: ${{ github.workspace }}/.github/codex
         prompt: |
           <instructions>
           ${{ env.AGENT_PROMPT }}