diff --git a/codex-rs/codex-client/src/outbound_proxy.rs b/codex-rs/codex-client/src/outbound_proxy.rs
index 9ec2a6d28e..71582764be 100644
--- a/codex-rs/codex-client/src/outbound_proxy.rs
+++ b/codex-rs/codex-client/src/outbound_proxy.rs
@@ -192,7 +192,7 @@ fn configure_proxy_for_route(
     match resolve_system_proxy(request_url, &origin, include_auto_detect) {
         SystemProxyDecision::Direct { source } => {
             RouteDiagnostic::direct(target, source, custom_ca_configured).emit_opt_in();
-            Ok(builder)
+            Ok(builder.no_proxy())
         }
         SystemProxyDecision::Proxy { source, url } => {
             configure_concrete_proxy(builder, target, source, &url, custom_ca_configured)
diff --git a/codex-rs/exec/src/lib.rs b/codex-rs/exec/src/lib.rs
index e857f358c9..f6088df77b 100644
--- a/codex-rs/exec/src/lib.rs
+++ b/codex-rs/exec/src/lib.rs
@@ -73,7 +73,7 @@ use codex_git_utils::get_git_repo_root;
 use codex_login::AuthConfig;
 use codex_login::default_client::set_default_client_residency_requirement;
 use codex_login::default_client::set_default_originator;
-use codex_login::enforce_login_restrictions;
+use codex_login::enforce_login_restrictions_with_network_config;
 use codex_model_provider_info::LMSTUDIO_OSS_PROVIDER_ID;
 use codex_model_provider_info::OLLAMA_OSS_PROVIDER_ID;
 use codex_otel::set_parent_from_context;
@@ -461,13 +461,16 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
 
     set_default_client_residency_requirement(config.enforce_residency.value());
 
-    if let Err(err) = enforce_login_restrictions(&AuthConfig {
-        codex_home: config.codex_home.to_path_buf(),
-        auth_credentials_store_mode: config.cli_auth_credentials_store_mode,
-        forced_login_method: config.forced_login_method,
-        forced_chatgpt_workspace_id: config.forced_chatgpt_workspace_id.clone(),
-        chatgpt_base_url: Some(config.chatgpt_base_url.clone()),
-    })
+    if let Err(err) = enforce_login_restrictions_with_network_config(
+        &AuthConfig {
+            codex_home: config.codex_home.to_path_buf(),
+            auth_credentials_store_mode: config.cli_auth_credentials_store_mode,
+            forced_login_method: config.forced_login_method,
+            forced_chatgpt_workspace_id: config.forced_chatgpt_workspace_id.clone(),
+            chatgpt_base_url: Some(config.chatgpt_base_url.clone()),
+        },
+        config.network.as_ref(),
+    )
     .await
     {
         eprintln!("{err}");
diff --git a/codex-rs/login/src/auth/manager.rs b/codex-rs/login/src/auth/manager.rs
index 380c3172ce..d960913a80 100644
--- a/codex-rs/login/src/auth/manager.rs
+++ b/codex-rs/login/src/auth/manager.rs
@@ -685,12 +685,21 @@ pub struct AuthConfig {
 }
 
 pub async fn enforce_login_restrictions(config: &AuthConfig) -> std::io::Result<()> {
+    enforce_login_restrictions_with_network_config(config, /*network_config*/ None).await
+}
+
+/// Enforces configured login restrictions using resolved outbound network settings.
+pub async fn enforce_login_restrictions_with_network_config(
+    config: &AuthConfig,
+    network_config: Option<&NetworkConfigToml>,
+) -> std::io::Result<()> {
+    let outbound_proxy_config = network_config.map(outbound_proxy_config_from_network_config);
     let Some(auth) = load_auth(
         &config.codex_home,
         /*enable_codex_api_key_env*/ true,
         config.auth_credentials_store_mode,
         config.chatgpt_base_url.as_deref(),
-        /*outbound_proxy_config*/ None,
+        outbound_proxy_config.as_ref(),
     )
     .await?
     else {
diff --git a/codex-rs/login/src/lib.rs b/codex-rs/login/src/lib.rs
index 2d98c12e93..f3e88fa69f 100644
--- a/codex-rs/login/src/lib.rs
+++ b/codex-rs/login/src/lib.rs
@@ -38,6 +38,7 @@ pub use auth::RefreshTokenError;
 pub use auth::UnauthorizedRecovery;
 pub use auth::default_client;
 pub use auth::enforce_login_restrictions;
+pub use auth::enforce_login_restrictions_with_network_config;
 pub use auth::load_auth_dot_json;
 pub use auth::login_with_access_token;
 pub use auth::login_with_access_token_with_proxy_config;
diff --git a/codex-rs/tui/src/lib.rs b/codex-rs/tui/src/lib.rs
index e9cc88dca1..9a5e2d5a38 100644
--- a/codex-rs/tui/src/lib.rs
+++ b/codex-rs/tui/src/lib.rs
@@ -48,7 +48,7 @@ use codex_exec_server::ExecServerRuntimePaths;
 use codex_login::AuthConfig;
 use codex_login::default_client::originator;
 use codex_login::default_client::set_default_client_residency_requirement;
-use codex_login::enforce_login_restrictions;
+use codex_login::enforce_login_restrictions_with_network_config;
 use codex_protocol::ThreadId;
 use codex_protocol::config_types::AltScreenMode;
 use codex_protocol::config_types::SandboxMode;
@@ -1185,13 +1185,16 @@ pub async fn run_main(
 
     if !app_server_target.uses_remote_workspace() {
         #[allow(clippy::print_stderr)]
-        if let Err(err) = enforce_login_restrictions(&AuthConfig {
-            codex_home: config.codex_home.to_path_buf(),
-            auth_credentials_store_mode: config.cli_auth_credentials_store_mode,
-            forced_login_method: config.forced_login_method,
-            forced_chatgpt_workspace_id: config.forced_chatgpt_workspace_id.clone(),
-            chatgpt_base_url: Some(config.chatgpt_base_url.clone()),
-        })
+        if let Err(err) = enforce_login_restrictions_with_network_config(
+            &AuthConfig {
+                codex_home: config.codex_home.to_path_buf(),
+                auth_credentials_store_mode: config.cli_auth_credentials_store_mode,
+                forced_login_method: config.forced_login_method,
+                forced_chatgpt_workspace_id: config.forced_chatgpt_workspace_id.clone(),
+                chatgpt_base_url: Some(config.chatgpt_base_url.clone()),
+            },
+            config.network.as_ref(),
+        )
         .await
         {
             eprintln!("{err}");