diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index c203e2b742..7115502364 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -494,8 +494,10 @@ jobs:
 
       # Save caches explicitly; make non-fatal so cache packaging
       # never fails the overall job. Only save when key wasn't hit.
+      # Lint/build jobs already save this cache key. Skipping the redundant
+      # Windows test-job save keeps the test jobs within their timeout budget.
       - name: Save cargo home cache
-        if: always() && !cancelled() && steps.cache_cargo_home_restore.outputs.cache-hit != 'true'
+        if: always() && !cancelled() && !startsWith(matrix.runner, 'windows') && steps.cache_cargo_home_restore.outputs.cache-hit != 'true'
         continue-on-error: true
         uses: actions/cache/save@v5
         with:
diff --git a/codex-rs/login/src/onboard_oauth_helper.rs b/codex-rs/login/src/onboard_oauth_helper.rs
index 76678031a5..5787cc9c40 100644
--- a/codex-rs/login/src/onboard_oauth_helper.rs
+++ b/codex-rs/login/src/onboard_oauth_helper.rs
@@ -511,14 +511,17 @@ fn handle_callback_request(
         Ok(url) => url,
         Err(err) => {
             return CallbackResponse {
-                response: html_response(400, format!("<h1>Bad Request</h1><p>{err}</p>")),
+                response: html_response(
+                    /*status*/ 400,
+                    format!("<h1>Bad Request</h1><p>{err}</p>"),
+                ),
                 result: None,
             };
         }
     };
     if parsed_url.path() != callback_path {
         return CallbackResponse {
-            response: html_response(404, "<h1>Not Found</h1>".to_string()),
+            response: html_response(/*status*/ 404, "<h1>Not Found</h1>".to_string()),
             result: None,
         };
     }
@@ -526,7 +529,7 @@ fn handle_callback_request(
     let params: HashMap<String, String> = parsed_url.query_pairs().into_owned().collect();
     if params.get("state").map(String::as_str) != Some(expected_state) {
         return CallbackResponse {
-            response: html_response(400, "<h1>State mismatch</h1>".to_string()),
+            response: html_response(/*status*/ 400, "<h1>State mismatch</h1>".to_string()),
             result: Some(Err("State mismatch in OAuth callback.".to_string())),
         };
     }
@@ -537,7 +540,7 @@ fn handle_callback_request(
         );
         return CallbackResponse {
             response: html_response(
-                403,
+                /*status*/ 403,
                 "<h1>Sign-in failed</h1><p>Return to your terminal.</p>".to_string(),
             ),
             result: Some(Err(message)),
@@ -546,13 +549,16 @@ fn handle_callback_request(
     match params.get("code") {
         Some(code) if !code.is_empty() => CallbackResponse {
             response: html_response(
-                200,
+                /*status*/ 200,
                 "<h1>Sign-in complete</h1><p>You can return to your terminal.</p>".to_string(),
             ),
             result: Some(Ok(code.clone())),
         },
         _ => CallbackResponse {
-            response: html_response(400, "<h1>Missing authorization code</h1>".to_string()),
+            response: html_response(
+                /*status*/ 400,
+                "<h1>Missing authorization code</h1>".to_string(),
+            ),
             result: Some(Err(
                 "Missing authorization code. Sign-in could not be completed.".to_string(),
             )),