diff --git a/.codex/config.toml b/.codex/config.toml
index a84b75d..15a8462 100644
--- a/.codex/config.toml
+++ b/.codex/config.toml
@@ -2,7 +2,7 @@ model = "gpt-5.3-codex"
 model_reasoning_effort = "medium"
 check_for_update_on_startup = false
 approval_policy = "on-request"
-sandbox_mode = "workspace-write"
+sandbox_mode = "read-only"
 allow_login_shell = false
 web_search = "cached"