diff --git a/codex-rs/core/src/session/handlers.rs b/codex-rs/core/src/session/handlers.rs
index 8fce55df25..e2dce6e693 100644
--- a/codex-rs/core/src/session/handlers.rs
+++ b/codex-rs/core/src/session/handlers.rs
@@ -323,10 +323,14 @@ async fn permission_profile_with_legacy_fallback(
 ) -> Option<PermissionProfile> {
     match (permission_profile, sandbox_policy) {
         (Some(permission_profile), _) => Some(permission_profile),
-        (None, Some(sandbox_policy)) => Some(
-            sess.permission_profile_from_legacy_sandbox_update(sandbox_policy, cwd)
-                .await,
-        ),
+        (None, Some(sandbox_policy)) => {
+            let state = sess.state.lock().await;
+            Some(
+                state
+                    .session_configuration
+                    .permission_profile_from_legacy_sandbox_update(sandbox_policy, cwd),
+            )
+        }
         (None, None) => None,
     }
 }
diff --git a/codex-rs/core/src/session/mod.rs b/codex-rs/core/src/session/mod.rs
index 6993766fb1..c28dce8183 100644
--- a/codex-rs/core/src/session/mod.rs
+++ b/codex-rs/core/src/session/mod.rs
@@ -338,7 +338,6 @@ use codex_protocol::protocol::Op;
 use codex_protocol::protocol::RateLimitSnapshot;
 use codex_protocol::protocol::RequestUserInputEvent;
 use codex_protocol::protocol::ReviewDecision;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::protocol::SessionConfiguredEvent;
 use codex_protocol::protocol::SessionNetworkProxyRuntime;
 use codex_protocol::protocol::SkillDependencies as ProtocolSkillDependencies;
@@ -1354,17 +1353,6 @@ impl Session {
         state.session_configuration.apply(updates).map(|_| ())
     }
 
-    pub(crate) async fn permission_profile_from_legacy_sandbox_update(
-        &self,
-        sandbox_policy: &SandboxPolicy,
-        cwd: Option<&Path>,
-    ) -> PermissionProfile {
-        let state = self.state.lock().await;
-        state
-            .session_configuration
-            .permission_profile_from_legacy_sandbox_update(sandbox_policy, cwd)
-    }
-
     pub(crate) async fn set_session_startup_prewarm(
         &self,
         startup_prewarm: SessionStartupPrewarmHandle,
diff --git a/codex-rs/core/src/session/session.rs b/codex-rs/core/src/session/session.rs
index 59a36ff68b..aa44490169 100644
--- a/codex-rs/core/src/session/session.rs
+++ b/codex-rs/core/src/session/session.rs
@@ -2,6 +2,7 @@ use super::*;
 use crate::goals::GoalRuntimeState;
 use codex_protocol::permissions::FileSystemPath;
 use codex_protocol::permissions::FileSystemSpecialPath;
+use codex_protocol::protocol::SandboxPolicy;
 use tokio::sync::Semaphore;
 
 /// Context for an initialized model agent