diff --git a/codex-rs/linux-sandbox/BUILD.bazel b/codex-rs/linux-sandbox/BUILD.bazel
index 2770b97e09..5ffa546500 100644
--- a/codex-rs/linux-sandbox/BUILD.bazel
+++ b/codex-rs/linux-sandbox/BUILD.bazel
@@ -6,4 +6,5 @@ codex_rust_crate(
     extra_binaries = [
         "//codex-rs/bwrap:bwrap",
     ],
+    integration_test_args = ["--test-threads=1"],
 )
diff --git a/codex-rs/linux-sandbox/tests/suite/landlock.rs b/codex-rs/linux-sandbox/tests/suite/landlock.rs
index 729a3bee07..f982d3cfc7 100644
--- a/codex-rs/linux-sandbox/tests/suite/landlock.rs
+++ b/codex-rs/linux-sandbox/tests/suite/landlock.rs
@@ -26,14 +26,14 @@ use tempfile::NamedTempFile;
 // At least on GitHub CI, the arm64 tests appear to need longer timeouts.
 
 #[cfg(not(target_arch = "aarch64"))]
-const SHORT_TIMEOUT_MS: u64 = 5_000;
+const SHORT_TIMEOUT_MS: u64 = 15_000;
 #[cfg(target_arch = "aarch64")]
-const SHORT_TIMEOUT_MS: u64 = 5_000;
+const SHORT_TIMEOUT_MS: u64 = 15_000;
 
 #[cfg(not(target_arch = "aarch64"))]
-const LONG_TIMEOUT_MS: u64 = 5_000;
+const LONG_TIMEOUT_MS: u64 = 15_000;
 #[cfg(target_arch = "aarch64")]
-const LONG_TIMEOUT_MS: u64 = 5_000;
+const LONG_TIMEOUT_MS: u64 = 15_000;
 
 #[cfg(not(target_arch = "aarch64"))]
 const NETWORK_TIMEOUT_MS: u64 = 10_000;
diff --git a/codex-rs/linux-sandbox/tests/suite/managed_proxy.rs b/codex-rs/linux-sandbox/tests/suite/managed_proxy.rs
index 71ed971506..4d731256b2 100644
--- a/codex-rs/linux-sandbox/tests/suite/managed_proxy.rs
+++ b/codex-rs/linux-sandbox/tests/suite/managed_proxy.rs
@@ -16,7 +16,7 @@ use std::time::Duration;
 use tokio::process::Command;
 
 const BWRAP_UNAVAILABLE_ERR: &str = "bubblewrap is unavailable: no system bwrap was found";
-const NETWORK_TIMEOUT_MS: u64 = 4_000;
+const NETWORK_TIMEOUT_MS: u64 = 15_000;
 const MANAGED_PROXY_PERMISSION_ERR_SNIPPETS: &[&str] = &[
     "loopback: Failed RTM_NEWADDR",
     "loopback: Failed RTM_NEWLINK",