diff --git a/codex-rs/config/src/types.rs b/codex-rs/config/src/types.rs
index c76a13a66b..4b9df5d1f7 100644
--- a/codex-rs/config/src/types.rs
+++ b/codex-rs/config/src/types.rs
@@ -101,6 +101,7 @@ impl fmt::Display for NetworkProxyMode {
 /// `http://proxy.example:8080`). It is deliberately not a PAC/WPAD URL, and
 /// callers must redact credentials before logging it.
 #[derive(Serialize, Deserialize, Default, Clone, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
 pub struct NetworkConfigToml {
     /// Proxy selection mode. Defaults to `auto` when omitted.
     #[serde(default)]