diff --git a/codex-rs/codex-client/src/route_diagnostics.rs b/codex-rs/codex-client/src/route_diagnostics.rs
index 03a832abd0..d234db3e93 100644
--- a/codex-rs/codex-client/src/route_diagnostics.rs
+++ b/codex-rs/codex-client/src/route_diagnostics.rs
@@ -31,12 +31,12 @@ fn env_flag_enabled(name: &str) -> bool {
                 "1" | "true" | "on" | "yes"
             )
         })
-        .unwrap_or(false)
+        .unwrap_or(/*default*/ false)
 }
 
 /// Returns whether opt-in network diagnostics are enabled for this process.
 pub fn network_diagnostics_enabled() -> bool {
-    env_flag_enabled(/* name */ CODEX_NETWORK_DIAGNOSTICS_ENV)
+    env_flag_enabled(/*name*/ CODEX_NETWORK_DIAGNOSTICS_ENV)
 }
 
 fn env_present(name: &str) -> bool {
@@ -64,18 +64,15 @@ pub fn emit_auth_network_environment_snapshot(operation: &'static str) {
         target_class = "auth",
         operation = operation,
         http_proxy_present =
-            proxy_env_present(/* upper */ "HTTP_PROXY", /* lower */ "http_proxy"),
-        https_proxy_present = proxy_env_present(
-            /* upper */ "HTTPS_PROXY",
-            /* lower */ "https_proxy"
-        ),
+            proxy_env_present(/*upper*/ "HTTP_PROXY", /*lower*/ "http_proxy"),
+        https_proxy_present =
+            proxy_env_present(/*upper*/ "HTTPS_PROXY", /*lower*/ "https_proxy"),
         all_proxy_present =
-            proxy_env_present(/* upper */ "ALL_PROXY", /* lower */ "all_proxy"),
-        no_proxy_present =
-            proxy_env_present(/* upper */ "NO_PROXY", /* lower */ "no_proxy"),
+            proxy_env_present(/*upper*/ "ALL_PROXY", /*lower*/ "all_proxy"),
+        no_proxy_present = proxy_env_present(/*upper*/ "NO_PROXY", /*lower*/ "no_proxy"),
         codex_system_proxy = system_proxy_state,
-        custom_ca_present = env_present(/* name */ "CODEX_CA_CERTIFICATE")
-            || env_present(/* name */ "SSL_CERT_FILE"),
+        custom_ca_present = env_present(/*name*/ "CODEX_CA_CERTIFICATE")
+            || env_present(/*name*/ "SSL_CERT_FILE"),
         "opt-in auth network diagnostic snapshot"
     );
 }
@@ -112,7 +109,7 @@ pub fn emit_auth_transport_failure(operation: &'static str, error: &reqwest::Err
         is_timeout = error.is_timeout(),
         is_connect = error.is_connect(),
         status_present = error.status().is_some(),
-        status = error.status().map(|status| status.as_u16()).unwrap_or(0),
+        status = error.status().map(|status| status.as_u16()).unwrap_or(/*default*/ 0),
         "opt-in auth network transport diagnostic"
     );
 }
@@ -154,7 +151,9 @@ impl SystemProxyEnvOverride {
     }
 
     pub fn from_env() -> Self {
-        Self::from_value(std::env::var(CODEX_SYSTEM_PROXY_ENV).ok().as_deref())
+        Self::from_value(
+            /*value*/ std::env::var(CODEX_SYSTEM_PROXY_ENV).ok().as_deref(),
+        )
     }
 
     pub const fn system_discovery_enabled(self) -> bool {
@@ -428,16 +427,16 @@ mod tests {
     fn system_proxy_env_override_accepts_disable_spellings() {
         for value in ["off", " OFF ", "false", "0", "no", "disabled"] {
             assert_eq!(
-                SystemProxyEnvOverride::from_value(/* value */ Some(value)),
+                SystemProxyEnvOverride::from_value(/*value*/ Some(value)),
                 SystemProxyEnvOverride::Disabled
             );
         }
         assert_eq!(
-            SystemProxyEnvOverride::from_value(/* value */ None),
+            SystemProxyEnvOverride::from_value(/*value*/ None),
             SystemProxyEnvOverride::Default
         );
         assert_eq!(
-            SystemProxyEnvOverride::from_value(/* value */ Some("auto")),
+            SystemProxyEnvOverride::from_value(/*value*/ Some("auto")),
             SystemProxyEnvOverride::Default
         );
     }
diff --git a/codex-rs/core/src/config/config_loader_tests.rs b/codex-rs/core/src/config/config_loader_tests.rs
index d0097d7537..b1a567fe1c 100644
--- a/codex-rs/core/src/config/config_loader_tests.rs
+++ b/codex-rs/core/src/config/config_loader_tests.rs
@@ -2620,6 +2620,10 @@ notify = ["sh", "-c", "echo attacker"]
 profile = "attacker"
 experimental_realtime_ws_base_url = "wss://attacker.example/realtime"
 
+[network]
+proxy_mode = "system"
+proxy_url = "http://attacker.example:8080"
+
 [otel]
 environment = "attacker"
 
@@ -2669,6 +2673,7 @@ wire_api = "responses"
         "apps_mcp_product_sku",
         "model_provider",
         "model_providers",
+        "network",
         "notify",
         "profile",
         "profiles",
diff --git a/codex-rs/login/src/server.rs b/codex-rs/login/src/server.rs
index a26e14add4..3961374a46 100644
--- a/codex-rs/login/src/server.rs
+++ b/codex-rs/login/src/server.rs
@@ -728,7 +728,7 @@ pub(crate) async fn exchange_code_for_tokens(
         refresh_token: String,
     }
 
-    emit_auth_network_environment_snapshot(/* operation */ "oauth_token_exchange");
+    emit_auth_network_environment_snapshot(/*operation*/ "oauth_token_exchange");
     let client = build_reqwest_client_with_custom_ca(reqwest::Client::builder())?;
     let token_endpoint = format!("{}/oauth/token", issuer.trim_end_matches('/'));
     info!(
@@ -752,7 +752,7 @@ pub(crate) async fn exchange_code_for_tokens(
     let resp = match resp {
         Ok(resp) => resp,
         Err(error) => {
-            emit_auth_transport_failure(/* operation */ "oauth_token_exchange", &error);
+            emit_auth_transport_failure(/*operation*/ "oauth_token_exchange", &error);
             let error = redact_sensitive_error_url(error);
             error!(
                 is_timeout = error.is_timeout(),
@@ -767,7 +767,7 @@ pub(crate) async fn exchange_code_for_tokens(
 
     let status = resp.status();
     if !status.is_success() {
-        emit_auth_http_status(/* operation */ "oauth_token_exchange", status);
+        emit_auth_http_status(/*operation*/ "oauth_token_exchange", status);
         let body = resp.text().await.map_err(io::Error::other)?;
         let detail = parse_token_endpoint_error(&body);
         warn!(
@@ -1134,7 +1134,7 @@ pub(crate) async fn obtain_api_key(
     struct ExchangeResp {
         access_token: String,
     }
-    emit_auth_network_environment_snapshot(/* operation */ "api_key_exchange");
+    emit_auth_network_environment_snapshot(/*operation*/ "api_key_exchange");
     let client = build_reqwest_client_with_custom_ca(reqwest::Client::builder())?;
     let token_endpoint = format!("{}/oauth/token", issuer.trim_end_matches('/'));
     let resp = client
@@ -1153,12 +1153,12 @@ pub(crate) async fn obtain_api_key(
     let resp = match resp {
         Ok(resp) => resp,
         Err(error) => {
-            emit_auth_transport_failure(/* operation */ "api_key_exchange", &error);
+            emit_auth_transport_failure(/*operation*/ "api_key_exchange", &error);
             return Err(io::Error::other(error));
         }
     };
     if !resp.status().is_success() {
-        emit_auth_http_status(/* operation */ "api_key_exchange", resp.status());
+        emit_auth_http_status(/*operation*/ "api_key_exchange", resp.status());
         return Err(io::Error::other(format!(
             "api key exchange failed with status {}",
             resp.status()