diff --git a/codex-rs/core/src/codex.rs b/codex-rs/core/src/codex.rs
index 0fe5f28523..41f0608daf 100644
--- a/codex-rs/core/src/codex.rs
+++ b/codex-rs/core/src/codex.rs
@@ -1348,6 +1348,7 @@ impl Session {
             otel_manager,
             models_manager: Arc::clone(&models_manager),
             tool_approvals: Mutex::new(ApprovalStore::default()),
+            execve_session_approvals: RwLock::new(HashSet::new()),
             skills_manager,
             file_watcher,
             agent_control,
diff --git a/codex-rs/core/src/state/service.rs b/codex-rs/core/src/state/service.rs
index 2a541d38a9..9831121672 100644
--- a/codex-rs/core/src/state/service.rs
+++ b/codex-rs/core/src/state/service.rs
@@ -1,3 +1,4 @@
+use std::collections::HashSet;
 use std::sync::Arc;
 
 use crate::AuthManager;
@@ -17,6 +18,7 @@ use crate::tools::sandboxing::ApprovalStore;
 use crate::unified_exec::UnifiedExecProcessManager;
 use codex_hooks::Hooks;
 use codex_otel::OtelManager;
+use codex_utils_absolute_path::AbsolutePathBuf;
 use std::path::PathBuf;
 use tokio::sync::Mutex;
 use tokio::sync::RwLock;
@@ -42,6 +44,7 @@ pub(crate) struct SessionServices {
     pub(crate) models_manager: Arc<ModelsManager>,
     pub(crate) otel_manager: OtelManager,
     pub(crate) tool_approvals: Mutex<ApprovalStore>,
+    pub(crate) execve_session_approvals: RwLock<HashSet<AbsolutePathBuf>>,
     pub(crate) skills_manager: Arc<SkillsManager>,
     pub(crate) file_watcher: Arc<FileWatcher>,
     pub(crate) agent_control: AgentControl,
diff --git a/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs b/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs
index 1b8e79f22b..4544afe43d 100644
--- a/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs
+++ b/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs
@@ -255,8 +255,20 @@ impl CoreShellActionProvider {
                 } else {
                     match self.prompt(program, argv, workdir, &self.stopwatch).await? {
                         ReviewDecision::Approved
-                        | ReviewDecision::ApprovedExecpolicyAmendment { .. }
-                        | ReviewDecision::ApprovedForSession => {
+                        | ReviewDecision::ApprovedExecpolicyAmendment { .. } => {
+                            if needs_escalation {
+                                EscalateAction::Escalate
+                            } else {
+                                EscalateAction::Run
+                            }
+                        }
+                        ReviewDecision::ApprovedForSession => {
+                            self.session
+                                .services
+                                .execve_session_approvals
+                                .write()
+                                .await
+                                .insert(program.clone());
                             if needs_escalation {
                                 EscalateAction::Escalate
                             } else {
@@ -325,8 +337,20 @@ impl EscalationPolicy for CoreShellActionProvider {
             // EscalateAction::Run case, rather than always escalating when a
             // skill matches.
             let needs_escalation = true;
+            let is_approved_for_session = self
+                .session
+                .services
+                .execve_session_approvals
+                .read()
+                .await
+                .contains(program);
+            let decision = if is_approved_for_session {
+                Decision::Allow
+            } else {
+                Decision::Prompt
+            };
             return self
-                .process_decision(Decision::Prompt, needs_escalation, program, argv, workdir)
+                .process_decision(decision, needs_escalation, program, argv, workdir)
                 .await;
         }