diff --git a/codex-rs/secrets/src/lib.rs b/codex-rs/secrets/src/lib.rs
index 280c723d36..74692324ab 100644
--- a/codex-rs/secrets/src/lib.rs
+++ b/codex-rs/secrets/src/lib.rs
@@ -140,7 +140,12 @@ impl SecretsManager {
 }
 
 pub fn environment_id_from_cwd(cwd: &Path) -> String {
-    if let Some(repo_root) = get_git_repo_root(cwd)
+    let repo_root = get_git_repo_root(cwd);
+    environment_id_from_cwd_with_repo_root(cwd, repo_root.as_deref())
+}
+
+fn environment_id_from_cwd_with_repo_root(cwd: &Path, repo_root: Option<&Path>) -> String {
+    if let Some(repo_root) = repo_root
         && let Some(name) = repo_root.file_name()
     {
         let name = name.to_string_lossy().trim().to_string();
@@ -189,7 +194,8 @@ mod tests {
     #[test]
     fn environment_id_fallback_has_cwd_prefix() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let env_id = environment_id_from_cwd(dir.path());
+        // The system temp directory may itself be nested under a Git marker.
+        let env_id = environment_id_from_cwd_with_repo_root(dir.path(), /*repo_root*/ None);
         let canonical = dir
             .path()
             .canonicalize()