diff --git a/src/targets/codex-adapter.ts b/src/targets/codex-adapter.ts
index 333dda86..ba22c63b 100644
--- a/src/targets/codex-adapter.ts
+++ b/src/targets/codex-adapter.ts
@@ -222,7 +222,7 @@ function prepareExplicitCodexHome(
   }
 
   try {
-    fs.mkdirSync(codexHome, { recursive: true });
+    fs.mkdirSync(codexHome, { mode: 0o700, recursive: true });
   } catch (err) {
     const error = err as NodeJS.ErrnoException;
     if (error.code !== 'EEXIST') {
diff --git a/tests/unit/targets/codex-runtime-integration.test.ts b/tests/unit/targets/codex-runtime-integration.test.ts
index a14dfed4..4018dd45 100644
--- a/tests/unit/targets/codex-runtime-integration.test.ts
+++ b/tests/unit/targets/codex-runtime-integration.test.ts
@@ -596,7 +596,9 @@ process.exit(0);
 
     expect(result.status).toBe(0);
     expect(fs.existsSync(freshCodexHome)).toBe(true);
-    expect(fs.statSync(freshCodexHome).isDirectory()).toBe(true);
+    const codexHomeStat = fs.statSync(freshCodexHome);
+    expect(codexHomeStat.isDirectory()).toBe(true);
+    expect(codexHomeStat.mode & 0o777).toBe(0o700);
     expect(readLoggedCodexCalls(codexArgsLogPath)).toEqual([
       ['-c', 'model="gpt-5"', '--version'],
       ['-c', 'model_reasoning_effort="high"', 'fix failing tests'],