diff --git a/modules/applications/codex/home.nix b/modules/applications/codex/home.nix
index 9499eb3..233bb46 100644
--- a/modules/applications/codex/home.nix
+++ b/modules/applications/codex/home.nix
@@ -6,7 +6,12 @@
   ...
 }:
 let
-  source = "${config.home.homeDirectory}/dotfiles/modules/applications/codex/config.toml";
+  configDirectory =
+    if config.home.preferXdgDirectories then
+      "${config.xdg.configHome}/codex"
+    else
+      "${config.home.homeDirectory}/.codex";
+  configFile = "${configDirectory}/config.toml";
 in
 {
   programs.codex = {
@@ -20,11 +25,14 @@ in
     };
   };
 
-  home.file = lib.mkIf (!config.home.preferXdgDirectories) {
-    ".codex/config.toml".source = config.lib.file.mkOutOfStoreSymlink source;
-  };
-
-  xdg.configFile = lib.mkIf config.home.preferXdgDirectories {
-    "codex/config.toml".source = config.lib.file.mkOutOfStoreSymlink source;
+  # Keep the repository copy as an initial value. Codex may mutate the live
+  # file between activations; each Home Manager switch resets it from here.
+  home.activation.resetCodexConfig = {
+    after = [ "writeBoundary" ];
+    before = [ ];
+    data = ''
+      ${pkgs.coreutils}/bin/mkdir -p ${lib.escapeShellArg configDirectory}
+      ${pkgs.coreutils}/bin/install -m 0600 ${./config.toml} ${lib.escapeShellArg configFile}
+    '';
   };
 }