diff --git a/codex-cli/package.json b/codex-cli/package.json
index 2f8df9b79f..0d6728dece 100644
--- a/codex-cli/package.json
+++ b/codex-cli/package.json
@@ -11,7 +11,7 @@
     "node": ">=16"
   },
   "files": [
-    "bin",
+    "bin/codex.js",
     "vendor"
   ],
   "repository": {
diff --git a/codex-cli/scripts/build_npm_package.py b/codex-cli/scripts/build_npm_package.py
index 5d4bc99c4e..261b9e0b61 100755
--- a/codex-cli/scripts/build_npm_package.py
+++ b/codex-cli/scripts/build_npm_package.py
@@ -255,9 +255,6 @@ def stage_sources(staging_dir: Path, version: str, package: str) -> None:
         bin_dir = staging_dir / "bin"
         bin_dir.mkdir(parents=True, exist_ok=True)
         shutil.copy2(CODEX_CLI_ROOT / "bin" / "codex.js", bin_dir / "codex.js")
-        rg_manifest = CODEX_CLI_ROOT / "bin" / "rg"
-        if rg_manifest.exists():
-            shutil.copy2(rg_manifest, bin_dir / "rg")
 
         readme_src = REPO_ROOT / "README.md"
         if readme_src.exists():
@@ -316,7 +313,7 @@ def stage_sources(staging_dir: Path, version: str, package: str) -> None:
         package_json["version"] = version
 
     if package == "codex":
-        package_json["files"] = ["bin"]
+        package_json["files"] = ["bin/codex.js"]
         package_json["optionalDependencies"] = {
             CODEX_PLATFORM_PACKAGES[platform_package]["npm_name"]: (
                 f"npm:{CODEX_NPM_NAME}@"
diff --git a/codex-cli/scripts/install_native_deps.py b/codex-cli/scripts/install_native_deps.py
index b785b2a877..de157334cd 100755
--- a/codex-cli/scripts/install_native_deps.py
+++ b/codex-cli/scripts/install_native_deps.py
@@ -20,9 +20,10 @@ from urllib.request import urlopen
 
 SCRIPT_DIR = Path(__file__).resolve().parent
 CODEX_CLI_ROOT = SCRIPT_DIR.parent
+REPO_ROOT = CODEX_CLI_ROOT.parent
 DEFAULT_WORKFLOW_URL = "https://github.com/openai/codex/actions/runs/26131514935"  # rust-v0.132.0
 VENDOR_DIR_NAME = "vendor"
-RG_MANIFEST = CODEX_CLI_ROOT / "bin" / "rg"
+RG_MANIFEST = REPO_ROOT / "scripts" / "codex_package" / "rg"
 BINARY_TARGETS = (
     "x86_64-unknown-linux-musl",
     "aarch64-unknown-linux-musl",
diff --git a/codex-cli/scripts/test_build_npm_package.py b/codex-cli/scripts/test_build_npm_package.py
new file mode 100644
index 0000000000..21afca8fe7
--- /dev/null
+++ b/codex-cli/scripts/test_build_npm_package.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+
+import importlib.util
+import json
+from pathlib import Path
+import tempfile
+import unittest
+
+
+BUILD_SCRIPT = Path(__file__).resolve().parent / "build_npm_package.py"
+SPEC = importlib.util.spec_from_file_location("codex_build_npm_package", BUILD_SCRIPT)
+if SPEC is None or SPEC.loader is None:
+    raise RuntimeError(f"Unable to load module from {BUILD_SCRIPT}")
+
+build_npm_package = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(build_npm_package)
+
+
+class StageSourcesTest(unittest.TestCase):
+    def test_codex_meta_package_omits_ripgrep_manifest(self) -> None:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            staging_dir = Path(temp_dir)
+
+            build_npm_package.stage_sources(staging_dir, "0.1.0", "codex")
+
+            with open(staging_dir / "package.json", encoding="utf-8") as fh:
+                package_json = json.load(fh)
+
+            self.assertTrue((staging_dir / "bin" / "codex.js").is_file())
+            self.assertFalse((staging_dir / "bin" / "rg").exists())
+            self.assertEqual(package_json["files"], ["bin/codex.js"])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/codex_package/README.md b/scripts/codex_package/README.md
index f53f1a41ad..8a1b392b20 100644
--- a/scripts/codex_package/README.md
+++ b/scripts/codex_package/README.md
@@ -56,7 +56,7 @@ Windows packages. This keeps package archive creation as a pure staging step
 after signing instead of rebuilding resources.
 
 `rg` is not built from this repository, so the builder fetches it from the
-DotSlash manifest at `codex-cli/bin/rg`. Downloaded archives are cached under
-`$TMPDIR/codex-package/<target>-rg` and are reused only after the recorded size
-and SHA-256 digest have been verified. Pass `--rg-bin` to use a local ripgrep
-executable instead.
+DotSlash manifest at `scripts/codex_package/rg`. Downloaded archives are cached
+under `$TMPDIR/codex-package/<target>-rg` and are reused only after the recorded
+size and SHA-256 digest have been verified. Pass `--rg-bin` to use a local
+ripgrep executable instead.
diff --git a/scripts/codex_package/cli.py b/scripts/codex_package/cli.py
index 36ceda589e..9c0b16258d 100644
--- a/scripts/codex_package/cli.py
+++ b/scripts/codex_package/cli.py
@@ -114,7 +114,7 @@ def parse_args() -> argparse.Namespace:
         type=Path,
         help=(
             "Optional local ripgrep executable override instead of fetching from "
-            "codex-cli/bin/rg."
+            "scripts/codex_package/rg."
         ),
     )
     return parser.parse_args()
diff --git a/codex-cli/bin/rg b/scripts/codex_package/rg
similarity index 100%
rename from codex-cli/bin/rg
rename to scripts/codex_package/rg
diff --git a/scripts/codex_package/ripgrep.py b/scripts/codex_package/ripgrep.py
index 5411cb579a..ce3ad7dc34 100644
--- a/scripts/codex_package/ripgrep.py
+++ b/scripts/codex_package/ripgrep.py
@@ -1,4 +1,4 @@
-"""Fetch ripgrep from the DotSlash manifest used by the npm package."""
+"""Fetch ripgrep from the DotSlash manifest used by the package builder."""
 
 import hashlib
 import json
@@ -17,7 +17,7 @@ from .targets import TargetSpec
 from .targets import resolve_input_path
 
 
-RG_MANIFEST = REPO_ROOT / "codex-cli" / "bin" / "rg"
+RG_MANIFEST = REPO_ROOT / "scripts" / "codex_package" / "rg"
 DOWNLOAD_TIMEOUT_SECS = 60