diff --git a/codex-rs/exec-server/src/noise_relay/mod.rs b/codex-rs/exec-server/src/noise_relay/mod.rs
index c4c50d7d0a..de71cb1900 100644
--- a/codex-rs/exec-server/src/noise_relay/mod.rs
+++ b/codex-rs/exec-server/src/noise_relay/mod.rs
@@ -1,4 +1,17 @@
+// These two modules intentionally land one stack layer before the remote
+// registration path starts the relay. Bazel compiles this PR as a library and
+// therefore sees their production-only entry points as dead, while the next
+// PR makes the same code reachable. Keep the allowances at the module boundary
+// so unrelated dead code elsewhere in exec-server remains an error.
+#[allow(
+    dead_code,
+    reason = "used by the remote Noise opt-in in the next stacked change"
+)]
 pub(crate) mod environment;
+#[allow(
+    dead_code,
+    reason = "used by the remote Noise opt-in in the next stacked change"
+)]
 mod executor_stream;
 mod harness;
 mod message_framing;