diff --git a/plugins/marginal/hooks/hooks.json b/plugins/marginal/hooks/hooks.json
index 8702011..4cfa849 100644
--- a/plugins/marginal/hooks/hooks.json
+++ b/plugins/marginal/hooks/hooks.json
@@ -62,7 +62,7 @@
             "type": "command",
             "command": "python3 \"$PLUGIN_ROOT/scripts/marginal_hook.py\"",
             "commandWindows": "py -3 \"%PLUGIN_ROOT%\\scripts\\marginal_hook.py\"",
-            "timeout": 5,
+            "timeout": 3,
             "statusMessage": "Closing MARGINAL session"
           }
         ]
diff --git a/plugins/marginal/runtime/marginal_runtime.pyz b/plugins/marginal/runtime/marginal_runtime.pyz
index d7a2228..7a238ef 100644
Binary files a/plugins/marginal/runtime/marginal_runtime.pyz and b/plugins/marginal/runtime/marginal_runtime.pyz differ
diff --git a/plugins/marginal/runtime/provenance.json b/plugins/marginal/runtime/provenance.json
index 3fc1355..d6871b2 100644
--- a/plugins/marginal/runtime/provenance.json
+++ b/plugins/marginal/runtime/provenance.json
@@ -1 +1 @@
-{"builder":"scripts/build_codex_plugin.py","python_requires":">=3.10","schema_version":1,"sha256":"d0a1d30db26ee34e723b84f4daa5644b9b749623d959dfc5d031f3b76d586283","source_hash":"41e1a773eeb8df465c8a560812bc83cd20c8bfd3760ccb8062c9f8780348c538"}
+{"builder":"scripts/build_codex_plugin.py","python_requires":">=3.10","schema_version":1,"sha256":"a8b9b82006b335a0800a5a9f59ad278a171f33edc962400b06283a056662d8eb","source_hash":"064f7cc94b6a614ded12aa3585c793ce88895d36278806c7374f81fe3140dca3"}
diff --git a/plugins/marginal/scripts/marginal_control.py b/plugins/marginal/scripts/marginal_control.py
index ea49cfc..585dc36 100644
--- a/plugins/marginal/scripts/marginal_control.py
+++ b/plugins/marginal/scripts/marginal_control.py
@@ -5,6 +5,7 @@
 
 import os
 import sys
+from contextlib import suppress
 from pathlib import Path
 
 from runtime_python import compatible_python
@@ -47,6 +48,8 @@ def main(argv: list[str] | None = None) -> int:
 
     data = _plugin_data()
     data.mkdir(parents=True, exist_ok=True, mode=0o700)
+    with suppress(OSError):
+        data.chmod(0o700)
     environment = {
         name: value
         for name in ("PATH", "CODEX_HOME", "LANG", "LC_ALL", "SYSTEMROOT")
diff --git a/plugins/marginal/scripts/marginal_hook.py b/plugins/marginal/scripts/marginal_hook.py
index 34a21df..a255b13 100644
--- a/plugins/marginal/scripts/marginal_hook.py
+++ b/plugins/marginal/scripts/marginal_hook.py
@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import os
+from contextlib import suppress
 from pathlib import Path
 
 from runtime_python import compatible_python
@@ -17,6 +18,10 @@ def main() -> int:
     runtime = Path(plugin_root).resolve() / "runtime" / "marginal_runtime.pyz"
     if not runtime.is_file():
         return 0
+
+    data = Path(plugin_data).resolve()
+    with suppress(OSError):
+        data.chmod(0o700)
     try:
         python = compatible_python()
     except RuntimeError:
@@ -26,7 +31,7 @@ def main() -> int:
         for name in ("PATH", "LANG", "LC_ALL", "SYSTEMROOT")
         if (value := os.environ.get(name)) is not None
     }
-    environment["PLUGIN_DATA"] = str(Path(plugin_data).resolve())
+    environment["PLUGIN_DATA"] = str(data)
     environment["PLUGIN_ROOT"] = str(Path(plugin_root).resolve())
     os.execve(python[0], [*python, str(runtime)], environment)
     return 0
diff --git a/src/marginal/integrations/codex/identity.py b/src/marginal/integrations/codex/identity.py
index 321244d..1d973d2 100644
--- a/src/marginal/integrations/codex/identity.py
+++ b/src/marginal/integrations/codex/identity.py
@@ -13,7 +13,7 @@
 PLUGIN_VERSION = "0.3.3"
 ADAPTER_VERSION = "1"
 POLICY_HASH = hashlib.sha256(b"marginal:no-progress:v1:max-same-evidence=2").hexdigest()
-DEFAULT_HOOK_HASH = "6d010b4849d8748d59e9d32e49e0ace08fc9a3dbc7a759b70336490b745a6190"
+DEFAULT_HOOK_HASH = "a013f9eae434e0558334b917f5bf42cbd844eca2e43454f9af80bbcbd0553dae"
 
 
 def repository_identity_hash(workspace: str | Path) -> str: