diff --git a/codex-rs/core/src/config/mod.rs b/codex-rs/core/src/config/mod.rs
index 651d7f769e..d5de707c5f 100644
--- a/codex-rs/core/src/config/mod.rs
+++ b/codex-rs/core/src/config/mod.rs
@@ -2522,8 +2522,8 @@ mod tests {
     use std::collections::BTreeMap;
     use std::collections::HashMap;
     use std::time::Duration;
-    use tempfile::tempdir;
     use tempfile::TempDir;
+    use tempfile::tempdir;
 
     fn stdio_mcp(command: &str) -> McpServerConfig {
         McpServerConfig {
diff --git a/codex-rs/core/src/config_loader/mod.rs b/codex-rs/core/src/config_loader/mod.rs
index 4f4f03d95c..a56fa97ef9 100644
--- a/codex-rs/core/src/config_loader/mod.rs
+++ b/codex-rs/core/src/config_loader/mod.rs
@@ -390,13 +390,36 @@ fn parse_requirements_toml_with_legacy_network_enabled_compat(
     contents: &str,
 ) -> Result<ConfigRequirementsToml, toml::de::Error> {
     let mut raw_requirements: TomlValue = toml::from_str(contents)?;
-    if let Some(network_table) = raw_requirements
+    let should_remove_network_table = raw_requirements
         .as_table_mut()
         .and_then(|table| table.get_mut("experimental_network"))
         .and_then(TomlValue::as_table_mut)
-        && network_table.remove("enabled").is_some()
+        .and_then(|network_table| network_table.remove("enabled"))
+        .map(|enabled| match enabled {
+            TomlValue::Boolean(false) => {
+                tracing::warn!(
+                    "Ignoring disabled legacy experimental_network table in requirements input"
+                );
+                true
+            }
+            TomlValue::Boolean(true) => {
+                tracing::warn!(
+                    "Ignoring legacy experimental_network.enabled in requirements input"
+                );
+                false
+            }
+            value => {
+                tracing::warn!(
+                    ?value,
+                    "Ignoring malformed legacy experimental_network.enabled in requirements input"
+                );
+                false
+            }
+        })
+        .unwrap_or(false);
+    if should_remove_network_table && let Some(requirements_table) = raw_requirements.as_table_mut()
     {
-        tracing::warn!("Ignoring legacy experimental_network.enabled in requirements input");
+        requirements_table.remove("experimental_network");
     }
     raw_requirements.try_into()
 }
diff --git a/codex-rs/core/src/config_loader/tests.rs b/codex-rs/core/src/config_loader/tests.rs
index cd63dc4145..02e72d14f0 100644
--- a/codex-rs/core/src/config_loader/tests.rs
+++ b/codex-rs/core/src/config_loader/tests.rs
@@ -698,6 +698,28 @@ allow_local_binding = true
     Ok(())
 }
 
+#[tokio::test(flavor = "current_thread")]
+async fn load_requirements_toml_ignores_disabled_legacy_network_table() -> anyhow::Result<()> {
+    let tmp = tempdir()?;
+    let requirements_file = tmp.path().join("requirements.toml");
+    tokio::fs::write(
+        &requirements_file,
+        r#"
+[experimental_network]
+enabled = false
+allow_local_binding = true
+"#,
+    )
+    .await?;
+
+    let mut config_requirements_toml = ConfigRequirementsWithSources::default();
+    load_requirements_toml(&mut config_requirements_toml, &requirements_file).await?;
+
+    assert_eq!(config_requirements_toml.network, None);
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "current_thread")]
 async fn cloud_requirements_are_not_overwritten_by_system_requirements() -> anyhow::Result<()> {
     let tmp = tempdir()?;