diff --git a/.codex/config.toml b/.codex/config.toml
new file mode 100644
index 0000000..871c290
--- /dev/null
+++ b/.codex/config.toml
@@ -0,0 +1,5 @@
+# Repo-local Codex defaults for this workspace.
+
+sandbox_mode = "workspace-write"
+approval_policy = "on-request"
+allow_login_shell = true
diff --git a/.gitignore b/.gitignore
index 97c4693..b8385bb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,3 +36,8 @@ coverage/
 # Claude Code (commit shared settings; ignore machine-local perms + transcripts)
 .claude/*
 !.claude/settings.json
+
+# Codex CLI
+!.codex/
+.codex/*
+!.codex/config.toml