diff --git a/codex-rs/core/src/context/prompts/permissions/network_proxy.md b/codex-rs/core/src/context/prompts/permissions/network_proxy.md
index 129b67cc88..5e8eaaef92 100644
--- a/codex-rs/core/src/context/prompts/permissions/network_proxy.md
+++ b/codex-rs/core/src/context/prompts/permissions/network_proxy.md
@@ -9,4 +9,4 @@ Interpret proxy failures precisely:
 - `blocked-by-denylist` means the host is explicitly denied by policy.
 - A message about local/private network addresses means the sandbox is blocking local or private targets.
 
-Do not infer a proxy denial from a generic network failure alone. Timeouts, hangs, DNS errors, TLS errors, and connection failures are only evidence of proxy policy when accompanied by proxy-specific headers or messages.
+Do not infer a proxy denial from a generic network failure alone. Proxy-mediated requests can themselves time out or hang. Treat timeouts, hangs, DNS errors, TLS errors, and connection failures as evidence of proxy policy only when they also include proxy-specific headers or messages.