diff --git a/codex-rs/app-server/src/config_api.rs b/codex-rs/app-server/src/config_api.rs
index 111f0c7685..425dd0999e 100644
--- a/codex-rs/app-server/src/config_api.rs
+++ b/codex-rs/app-server/src/config_api.rs
@@ -678,6 +678,7 @@ mod tests {
             allowed_approvals_reviewers: None,
             allowed_sandbox_modes: None,
             allowed_web_search_modes: None,
+            allow_managed_hooks_only: None,
             guardian_developer_instructions: None,
             feature_requirements: None,
             mcp_servers: None,
diff --git a/codex-rs/cloud-requirements/src/lib.rs b/codex-rs/cloud-requirements/src/lib.rs
index ad4ebed12f..0f11fcdc86 100644
--- a/codex-rs/cloud-requirements/src/lib.rs
+++ b/codex-rs/cloud-requirements/src/lib.rs
@@ -1157,6 +1157,7 @@ mod tests {
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1186,6 +1187,7 @@ mod tests {
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1215,6 +1217,7 @@ mod tests {
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1261,6 +1264,7 @@ mod tests {
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1343,6 +1347,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1415,6 +1420,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1485,6 +1491,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1649,6 +1656,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1684,6 +1692,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1739,6 +1748,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1789,6 +1799,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1843,6 +1854,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1898,6 +1910,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -1953,6 +1966,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -2041,6 +2055,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
@@ -2068,6 +2083,7 @@ enabled = false
                 allowed_approvals_reviewers: None,
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
+                allow_managed_hooks_only: None,
                 guardian_developer_instructions: None,
                 feature_requirements: None,
                 mcp_servers: None,
diff --git a/codex-rs/core/tests/suite/hooks.rs b/codex-rs/core/tests/suite/hooks.rs
index 8dbf4bc7f8..51a35353c8 100644
--- a/codex-rs/core/tests/suite/hooks.rs
+++ b/codex-rs/core/tests/suite/hooks.rs
@@ -448,16 +448,16 @@ fn sse_event(event: Value) -> String {
     sse(vec![event])
 }
 
-fn enable_managed_hooks_only(config: &mut Config) {
+fn enable_managed_hooks_only(config: &mut Config) -> Result<()> {
     let system_dir = config.codex_home.join("managed");
     let system_config_file =
         AbsolutePathBuf::from_absolute_path(system_dir.join(codex_config::CONFIG_TOML_FILE))
-            .expect("absolute managed config path");
+            .context("absolute managed config path")?;
     let mut layers = config
         .config_layer_stack
         .get_layers(
             codex_config::ConfigLayerStackOrdering::LowestPrecedenceFirst,
-            true,
+            /*include_disabled*/ true,
         )
         .into_iter()
         .cloned()
@@ -473,12 +473,15 @@ fn enable_managed_hooks_only(config: &mut Config) {
     );
 
     let mut requirements = config.config_layer_stack.requirements().clone();
-    requirements.allow_managed_hooks_only =
-        Some(Sourced::new(true, RequirementSource::CloudRequirements));
+    requirements.allow_managed_hooks_only = Some(Sourced::new(
+        /*value*/ true,
+        RequirementSource::CloudRequirements,
+    ));
     let mut requirements_toml = config.config_layer_stack.requirements_toml().clone();
     requirements_toml.allow_managed_hooks_only = Some(true);
     config.config_layer_stack = ConfigLayerStack::new(layers, requirements, requirements_toml)
-        .expect("rebuild config layer stack with managed hooks requirement");
+        .context("rebuild config layer stack with managed hooks requirement")?;
+    Ok(())
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -545,7 +548,9 @@ async fn managed_hooks_only_skips_user_hooks() -> Result<()> {
                 .features
                 .enable(Feature::CodexHooks)
                 .expect("test config should allow feature update");
-            enable_managed_hooks_only(config);
+            if let Err(error) = enable_managed_hooks_only(config) {
+                panic!("failed to enable managed-hooks-only test config: {error:#}");
+            }
         });
     let test = builder.build(&server).await?;