diff --git a/.codex/config.toml b/.codex/config.toml
new file mode 100644
index 0000000..03f36da
--- /dev/null
+++ b/.codex/config.toml
@@ -0,0 +1,34 @@
+model = "gpt-5.4"
+model_reasoning_effort = "xhigh"
+personality = "pragmatic"
+plan_mode_reasoning_effort = "xhigh"
+
+approval_policy = "on-request"
+sandbox_mode = "workspace-write"
+web_search = "live"
+
+notify = [
+  "terminal-notifier",
+  "-title", "Codex CLI",
+  "-message", "Task completed!",
+  "-sound", "default",
+]
+
+[features]
+multi_agent = true
+prevent_idle_sleep = true
+
+[agents]
+max_threads = 6
+max_depth = 1
+
+[tui]
+status_line = ["model-with-reasoning", "context-remaining", "current-dir", "git-branch", "five-hour-limit"]
+
+[sandbox_workspace_write]
+network_access = true
+
+[mcp_servers.mcp-nixos]
+command = "nix"
+args = ["run", "github:utensils/mcp-nixos", "--"]
+
diff --git a/.codex/rules/default.rules b/.codex/rules/default.rules
new file mode 100644
index 0000000..d81a6e2
--- /dev/null
+++ b/.codex/rules/default.rules
@@ -0,0 +1,34 @@
+prefix_rule(
+  pattern = ["just"],
+  decision = "allow",
+  justification = "Executing Justfile commands is allowed",
+  match = [
+    "just",
+    "just darwin",
+    "just darwin-debug",
+  ],
+)
+
+prefix_rule(
+  pattern = ["git"],
+  decision = "allow",
+  justification = "Git is allowed",
+  match = [
+    "git add .",
+    "git commit -m",
+    "git worktree",
+    "git status",
+    "git log",
+    "git branch",
+  ],
+)
+
+prefix_rule(
+  pattern = ["gh"],
+  decision = "allow",
+  justification = "Github CLI is allowed",
+  match = [
+    "gh pr",
+    "gh repo",
+  ],
+)