diff --git a/codex-rs/core/tests/suite/tools.rs b/codex-rs/core/tests/suite/tools.rs
index fd19a18c76..400363950c 100644
--- a/codex-rs/core/tests/suite/tools.rs
+++ b/codex-rs/core/tests/suite/tools.rs
@@ -407,7 +407,9 @@ async fn shell_command_enforces_glob_deny_read_policy() -> Result<()> {
     let args = json!({
         "command": command,
         "login": false,
-        "timeout_ms": 1_000,
+        // This test exercises glob deny/read behavior. Under full Bazel load,
+        // sandbox startup alone can exceed one second.
+        "timeout_ms": 10_000,
     });
 
     let responses = vec![