diff --git a/.bazelrc b/.bazelrc
index 0d2f4389cc..0736ecbb6e 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -117,6 +117,7 @@ build:clippy --@rules_rust//rust/settings:clippy.toml=//codex-rs:clippy.toml
 build:clippy --@rules_rust//rust/settings:clippy_flag=-Dwarnings
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::await_holding_invalid_type
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::await_holding_lock
+build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::disallowed_methods
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::expect_used
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::identity_op
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::manual_clamp
diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml
index 0222004c1d..4ed8a1f5b8 100644
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -409,6 +409,7 @@ symphonia = { version = "0.6.0", default-features = false, features = [
     "wav",
 ] }
 socket2 = "0.6.1"
+# When bumping sqlx, audit the SQLite constructor deny list in clippy.toml.
 sqlx = { version = "0.9.0", default-features = false, features = [
     "chrono",
     "json",
@@ -482,6 +483,7 @@ rust = {}
 [workspace.lints.clippy]
 await_holding_invalid_type = "deny"
 await_holding_lock = "deny"
+disallowed_methods = "deny"
 expect_used = "deny"
 identity_op = "deny"
 manual_clamp = "deny"
diff --git a/codex-rs/clippy.toml b/codex-rs/clippy.toml
index 2feed8a487..f16a05180a 100644
--- a/codex-rs/clippy.toml
+++ b/codex-rs/clippy.toml
@@ -11,6 +11,20 @@ disallowed-methods = [
     { path = "ratatui::style::Stylize::white", reason = "Avoid hardcoding white; prefer default fg or dim/bold. Exception: Disable this rule if rendering over a hardcoded ANSI background." },
     { path = "ratatui::style::Stylize::black", reason = "Avoid hardcoding black; prefer default fg or dim/bold. Exception: Disable this rule if rendering over a hardcoded ANSI background." },
     { path = "ratatui::style::Stylize::yellow", reason = "Avoid yellow; prefer other colors in `tui/styles.md`." },
+    # Audited against workspace sqlx 0.9.0. Revisit this SQLite escape-hatch list when bumping sqlx.
+    { path = "sqlx::Pool::connect", reason = "Create SQLite pools through codex-state's sqlite shim." },
+    { path = "sqlx::Pool::connect_with", reason = "Create SQLite pools through codex-state's sqlite shim." },
+    { path = "sqlx::Pool::connect_lazy", reason = "Create SQLite pools through codex-state's sqlite shim." },
+    { path = "sqlx::Pool::connect_lazy_with", reason = "Create SQLite pools through codex-state's sqlite shim." },
+    { path = "sqlx::Pool::set_connect_options", reason = "Do not replace options on SQLite pools created by codex-state's sqlite shim." },
+    { path = "sqlx::pool::PoolOptions::connect", reason = "Create SQLite pools through codex-state's sqlite shim." },
+    { path = "sqlx::pool::PoolOptions::connect_with", reason = "Create SQLite pools through codex-state's sqlite shim." },
+    { path = "sqlx::pool::PoolOptions::connect_lazy", reason = "Create SQLite pools through codex-state's sqlite shim." },
+    { path = "sqlx::pool::PoolOptions::connect_lazy_with", reason = "Create SQLite pools through codex-state's sqlite shim." },
+    { path = "sqlx::Connection::connect", reason = "Create SQLite connections through codex-state's sqlite shim." },
+    { path = "sqlx::Connection::connect_with", reason = "Create SQLite connections through codex-state's sqlite shim." },
+    { path = "sqlx::ConnectOptions::connect", reason = "Create SQLite connections through codex-state's sqlite shim." },
+    { path = "sqlx::migrate::MigrateDatabase::create_database", reason = "Create SQLite databases through codex-state's sqlite shim." },
 ]
 
 # Increase the size threshold for result_large_err to accommodate
diff --git a/codex-rs/state/src/sqlite.rs b/codex-rs/state/src/sqlite.rs
index a32d0989d8..5fd1cf5357 100644
--- a/codex-rs/state/src/sqlite.rs
+++ b/codex-rs/state/src/sqlite.rs
@@ -1,5 +1,10 @@
 //! Shared SQLite connection configuration.
 
+#![expect(
+    clippy::disallowed_methods,
+    reason = "this is the centralized SQLite connection shim"
+)]
+
 use crate::DbTelemetry;
 use crate::migrations::repair_legacy_recency_migration_version;
 use crate::runtime::RuntimeDbInitError;