diff --git a/codex-rs/protocol/src/shell_environment.rs b/codex-rs/protocol/src/shell_environment.rs
index 5983574aaf..c96cd1dfba 100644
--- a/codex-rs/protocol/src/shell_environment.rs
+++ b/codex-rs/protocol/src/shell_environment.rs
@@ -72,6 +72,13 @@ where
         }
     };
 
+    // Remove RUST_LOG if present.
+    // Harnesses like Codex Desktop and the VS Code extension will
+    // spawn the app-server with `RUST_LOG=warn` by default, which can then cause
+    // unexpected behavior in subprocesses. Users can still explicitly include
+    // it via overrides.
+    env_map.remove("RUST_LOG");
+
     let matches_any = |name: &str, patterns: &[EnvironmentVariablePattern]| -> bool {
         patterns.iter().any(|pattern| pattern.matches(name))
     };
@@ -82,12 +89,6 @@ where
             EnvironmentVariablePattern::new_case_insensitive("*KEY*"),
             EnvironmentVariablePattern::new_case_insensitive("*SECRET*"),
             EnvironmentVariablePattern::new_case_insensitive("*TOKEN*"),
-            // Harnesses like Codex Desktop and the VS Code extension
-            // will spawn the app-server with `RUST_LOG=warn` by default,
-            // which can then cause unexpected behavior in subprocesses.
-            // This removes it by default; users can still explicitly
-            // include it via overrides.
-            EnvironmentVariablePattern::new("RUST_LOG"),
         ];
         env_map.retain(|k, _| !matches_any(k, &default_excludes));
     }