diff --git a/codex-rs/linux-sandbox/src/bwrap.rs b/codex-rs/linux-sandbox/src/bwrap.rs
index f0e188b255..76853ed337 100644
--- a/codex-rs/linux-sandbox/src/bwrap.rs
+++ b/codex-rs/linux-sandbox/src/bwrap.rs
@@ -718,9 +718,12 @@ fn expand_unreadable_globs_with_ripgrep(
     // lets one `rg --files` call handle all patterns under the same root.
     let mut patterns_by_search_root: BTreeMap<AbsolutePathBuf, Vec<String>> = BTreeMap::new();
     for pattern in patterns {
-        if let Some((search_root, glob)) = split_pattern_for_ripgrep(pattern, cwd)
-            && search_root.as_path().is_dir()
-        {
+        let Some((search_root, glob)) = split_pattern_for_ripgrep(pattern, cwd) else {
+            return Err(CodexErr::Fatal(format!(
+                "unreadable glob `{pattern}` cannot be safely expanded; use a pattern with a non-root directory prefix"
+            )));
+        };
+        if search_root.as_path().is_dir() {
             patterns_by_search_root
                 .entry(search_root)
                 .or_default()
@@ -2674,10 +2677,20 @@ mod tests {
     }
 
     #[test]
-    fn root_prefix_unreadable_globs_are_too_broad_for_linux_expansion() {
+    fn root_prefix_unreadable_globs_fail_closed_on_linux() {
+        let policy = default_policy_with_unreadable_glob("/**/*.env".to_string());
+        let error = create_bwrap_command_args(
+            vec!["/bin/true".to_string()],
+            &policy,
+            Path::new("/tmp"),
+            Path::new("/tmp"),
+            BwrapOptions::default(),
+        )
+        .expect_err("root-prefix deny-read glob must reject sandbox construction");
+
         assert_eq!(
-            split_pattern_for_ripgrep("/**/*.env", Path::new("/tmp")),
-            None
+            error.to_string(),
+            "Fatal error: unreadable glob `/**/*.env` cannot be safely expanded; use a pattern with a non-root directory prefix"
         );
     }