diff --git a/codex-rs/rollout/src/recorder_tests.rs b/codex-rs/rollout/src/recorder_tests.rs
index 6e1f65b50d..69f133e050 100644
--- a/codex-rs/rollout/src/recorder_tests.rs
+++ b/codex-rs/rollout/src/recorder_tests.rs
@@ -1105,7 +1105,7 @@ async fn resume_candidate_matches_cwd_reads_latest_turn_context() -> std::io::Re
             current_date: None,
             timezone: None,
             approval_policy: AskForApproval::Never,
-            sandbox_policy: permission_profile.to_legacy_sandbox_policy(latest_cwd.as_path())?,
+            sandbox_policy: None,
             permission_profile: Some(permission_profile),
             network: None,
             file_system_sandbox_policy: None,
diff --git a/codex-rs/state/src/extract.rs b/codex-rs/state/src/extract.rs
index 633eb63404..ba5093ca12 100644
--- a/codex-rs/state/src/extract.rs
+++ b/codex-rs/state/src/extract.rs
@@ -303,9 +303,7 @@ mod tests {
                 current_date: None,
                 timezone: None,
                 approval_policy: AskForApproval::Never,
-                sandbox_policy: PermissionProfile::read_only()
-                    .to_legacy_sandbox_policy(Path::new("/"))
-                    .expect("read-only profile should project to legacy sandbox"),
+                sandbox_policy: None,
                 permission_profile: Some(PermissionProfile::Disabled),
                 network: None,
                 file_system_sandbox_policy: None,
@@ -342,9 +340,11 @@ mod tests {
                 current_date: None,
                 timezone: None,
                 approval_policy: AskForApproval::OnRequest,
-                sandbox_policy: PermissionProfile::read_only()
-                    .to_legacy_sandbox_policy(Path::new("/"))
-                    .expect("read-only profile should project to legacy sandbox"),
+                sandbox_policy: Some(
+                    PermissionProfile::read_only()
+                        .to_legacy_sandbox_policy(Path::new("/"))
+                        .expect("read-only profile should project to legacy sandbox"),
+                ),
                 permission_profile: None,
                 network: None,
                 file_system_sandbox_policy: None,
@@ -378,9 +378,11 @@ mod tests {
                 current_date: None,
                 timezone: None,
                 approval_policy: AskForApproval::OnRequest,
-                sandbox_policy: PermissionProfile::read_only()
-                    .to_legacy_sandbox_policy(Path::new("/"))
-                    .expect("read-only profile should project to legacy sandbox"),
+                sandbox_policy: Some(
+                    PermissionProfile::read_only()
+                        .to_legacy_sandbox_policy(Path::new("/"))
+                        .expect("read-only profile should project to legacy sandbox"),
+                ),
                 permission_profile: None,
                 network: None,
                 file_system_sandbox_policy: None,