diff --git a/.chezmoiscripts/run_onchange_after_install-codex.sh.tmpl b/.chezmoiscripts/run_onchange_after_install-codex.sh.tmpl
new file mode 100644
index 0000000..7eb64fb
--- /dev/null
+++ b/.chezmoiscripts/run_onchange_after_install-codex.sh.tmpl
@@ -0,0 +1,51 @@
+#!/bin/bash
+# Install the Codex CLI via mise (npm backend) and ensure its shared-home config
+# dir exists so setup-shared-symlinks can persist interactive login (~/.codex).
+# This script runs when its content changes.
+
+{{ if .include_defaults -}}
+set -e
+
+if ! command -v mise >/dev/null 2>&1; then
+    echo "⚠️  mise not found, skipping Codex install"
+    exit 0
+fi
+
+# codex is a mise-managed tool (npm:@openai/codex) with a shim under
+# ~/.local/share/mise/shims; verify with `mise which` (works without mise on PATH).
+codex_installed() { mise which codex >/dev/null 2>&1; }
+
+if codex_installed; then
+    echo "✓ Codex CLI already installed"
+else
+    echo "Installing Codex CLI via mise (npm:@openai/codex)..."
+    # The npm backend needs node; ensure it (this script may run before the
+    # general mise-tools install). node@lts is already in the mise config.
+    mise use -g node@lts >/dev/null 2>&1 || true
+    mise use -g "npm:@openai/codex@latest"
+    if codex_installed; then
+        echo "✓ Codex CLI installed successfully"
+    else
+        echo "⚠️  Codex CLI installation may have failed"
+        exit 1
+    fi
+fi
+
+# In Coder workspaces, persist Codex config + interactive login (~/.codex) to the
+# shared home so it survives workspace rebuilds. Create the symlink here directly
+# rather than relying on setup-shared-symlinks: that script is run_onchange and
+# won't re-run on an unchanged upgrade, so ~/.codex wouldn't be linked.
+if [ "$CODER" = "true" ]; then
+    SHARED_CODEX="${DOTFILES_SHARED_HOME:-/shared/home/default}/.codex"
+    mkdir -p "$SHARED_CODEX"
+    if [ ! -L "$HOME/.codex" ]; then
+        # Migrate any pre-existing real ~/.codex (e.g. a prior login) into shared
+        # without clobbering, then replace it with the symlink.
+        if [ -d "$HOME/.codex" ]; then
+            cp -an "$HOME/.codex/." "$SHARED_CODEX/" 2>/dev/null || true
+            rm -rf "$HOME/.codex"
+        fi
+        ln -sfn "$SHARED_CODEX" "$HOME/.codex"
+    fi
+fi
+{{ end -}}
diff --git a/dot_bash_aliases b/dot_bash_aliases
index aaca09a..0829503 100644
--- a/dot_bash_aliases
+++ b/dot_bash_aliases
@@ -1,7 +1,7 @@
 # Bash aliases
 
-# Claude CLI - skip permissions prompt
-alias claude="ENABLE_CLAUDEAI_MCP_SERVERS=false claude --dangerously-skip-permissions"
+# Claude CLI - skip permissions prompt; DISABLE_AUTOUPDATER so mise owns the version.
+alias claude="DISABLE_AUTOUPDATER=1 ENABLE_CLAUDEAI_MCP_SERVERS=false claude --dangerously-skip-permissions"
 # ccc — attach to (or create) a persistent tmux session running Claude Code.
 # Survives terminal disconnects and is reachable over SSH; `claude` above still
 # launches Claude directly (no tmux). Named ccc (not cc) to avoid shadowing the
@@ -19,3 +19,15 @@ ccc() {
   command -v tmux >/dev/null 2>&1 || { claude; return; }
   tmux attach -t claude 2>/dev/null || tmux new -s claude "bash -ic 'claude; exec bash -i'"
 }
+
+# cdx — attach to (or create) a persistent tmux session running the Codex CLI.
+# Sibling of ccc. `codex` config + interactive login live in the shared-home
+# ~/.codex (persisted across workspaces), so run `codex login` once.
+cdx() {
+  if [ "$(id -u)" = "0" ]; then
+    local u; u=$(id -un 1000 2>/dev/null) || true
+    [ -n "$u" ] && exec su -s /bin/bash "$u" -c "export HOME='$HOME'; exec bash -ic cdx"
+  fi
+  command -v tmux >/dev/null 2>&1 || { codex; return; }
+  tmux attach -t codex 2>/dev/null || tmux new -s codex "bash -ic 'codex; exec bash -i'"
+}
diff --git a/dot_config/fish/config.fish.tmpl b/dot_config/fish/config.fish.tmpl
index 92ca254..94a2760 100644
--- a/dot_config/fish/config.fish.tmpl
+++ b/dot_config/fish/config.fish.tmpl
@@ -17,7 +17,7 @@ if type -q mise
 end
 
 # Aliases
-alias claude='ANTHROPIC_MODEL=claude-opus-4-7 ENABLE_CLAUDEAI_MCP_SERVERS=false command claude --dangerously-skip-permissions'
+alias claude='DISABLE_AUTOUPDATER=1 ENABLE_CLAUDEAI_MCP_SERVERS=false command claude --dangerously-skip-permissions'
 
 # ccc — attach to (or create) a persistent tmux session running Claude Code.
 # Named ccc (not cc) to avoid shadowing the system C compiler at /usr/bin/cc.
@@ -35,5 +35,17 @@ function ccc --description 'Persistent Claude Code session via tmux'
     tmux attach -t claude 2>/dev/null; or tmux new -s claude "fish -C claude"
 end
 
+# cdx — attach to (or create) a persistent tmux session running the Codex CLI.
+function cdx --description 'Persistent Codex CLI session via tmux'
+    if test (id -u) -eq 0; and id -un 1000 >/dev/null 2>&1
+        exec bash -ic cdx
+    end
+    if not type -q tmux
+        codex
+        return
+    end
+    tmux attach -t codex 2>/dev/null; or tmux new -s codex "fish -C codex"
+end
+
 # Source local machine-specific config (not managed by dotfiles)
 test -f ~/.config/fish/config.local.fish && source ~/.config/fish/config.local.fish