diff --git a/codex-rs/windows-sandbox-rs/src/elevated/command_runner_win.rs b/codex-rs/windows-sandbox-rs/src/elevated/command_runner_win.rs
index 87b0e2a812..74fc34c5ea 100644
--- a/codex-rs/windows-sandbox-rs/src/elevated/command_runner_win.rs
+++ b/codex-rs/windows-sandbox-rs/src/elevated/command_runner_win.rs
@@ -159,7 +159,7 @@ fn read_spawn_request(
 }
 
 /// Pick an effective CWD, using a junction if the ACL helper is active.
-fn effective_cwd(req_cwd: &Path, log_dir: Option<&Path>) -> PathBuf {
+fn effective_cwd(req_cwd: &Path, sandbox_home: &Path, log_dir: Option<&Path>) -> PathBuf {
     let use_junction = match read_acl_mutex::read_acl_mutex_exists() {
         Ok(exists) => exists,
         Err(err) => {
@@ -177,7 +177,8 @@ fn effective_cwd(req_cwd: &Path, log_dir: Option<&Path>) -> PathBuf {
             "junction: read ACL helper running; using junction CWD",
             log_dir,
         );
-        cwd_junction::create_cwd_junction(req_cwd, log_dir).unwrap_or_else(|| req_cwd.to_path_buf())
+        cwd_junction::create_cwd_junction(req_cwd, sandbox_home, log_dir)
+            .unwrap_or_else(|| req_cwd.to_path_buf())
     } else {
         req_cwd.to_path_buf()
     }
@@ -240,7 +241,7 @@ fn spawn_ipc_process(
         }
     }
 
-    let effective_cwd = effective_cwd(&req.cwd, Some(log_dir.as_path()));
+    let effective_cwd = effective_cwd(&req.cwd, req.codex_home.as_path(), Some(log_dir.as_path()));
     log_note(
         &format!(
             "runner: effective cwd={} (requested {})",
diff --git a/codex-rs/windows-sandbox-rs/src/elevated/cwd_junction.rs b/codex-rs/windows-sandbox-rs/src/elevated/cwd_junction.rs
index 4765686b34..ebaae8b190 100644
--- a/codex-rs/windows-sandbox-rs/src/elevated/cwd_junction.rs
+++ b/codex-rs/windows-sandbox-rs/src/elevated/cwd_junction.rs
@@ -16,16 +16,16 @@ fn junction_name_for_path(path: &Path) -> String {
     format!("{:x}", hasher.finish())
 }
 
-fn junction_root_for_userprofile(userprofile: &str) -> PathBuf {
-    PathBuf::from(userprofile)
-        .join(".codex")
-        .join(".sandbox")
-        .join("cwd")
+fn junction_root_for_sandbox_home(sandbox_home: &Path) -> PathBuf {
+    sandbox_home.join("cwd")
 }
 
-pub fn create_cwd_junction(requested_cwd: &Path, log_dir: Option<&Path>) -> Option<PathBuf> {
-    let userprofile = std::env::var("USERPROFILE").ok()?;
-    let junction_root = junction_root_for_userprofile(&userprofile);
+pub fn create_cwd_junction(
+    requested_cwd: &Path,
+    sandbox_home: &Path,
+    log_dir: Option<&Path>,
+) -> Option<PathBuf> {
+    let junction_root = junction_root_for_sandbox_home(sandbox_home);
     if let Err(err) = std::fs::create_dir_all(&junction_root) {
         log_note(
             &format!(
@@ -140,3 +140,18 @@ pub fn create_cwd_junction(requested_cwd: &Path, log_dir: Option<&Path>) -> Opti
     );
     None
 }
+
+#[cfg(test)]
+mod tests {
+    use super::junction_root_for_sandbox_home;
+    use std::path::Path;
+
+    #[test]
+    fn junction_root_uses_sandbox_home_instead_of_userprofile() {
+        let sandbox_home = Path::new(r"C:\Users\alice\.codex\.sandbox");
+        assert_eq!(
+            junction_root_for_sandbox_home(sandbox_home),
+            Path::new(r"C:\Users\alice\.codex\.sandbox\cwd")
+        );
+    }
+}