diff --git a/codex-rs/core/tests/suite/windows_sandbox.rs b/codex-rs/core/tests/suite/windows_sandbox.rs
index d3eabe12b7..6614a63bb7 100644
--- a/codex-rs/core/tests/suite/windows_sandbox.rs
+++ b/codex-rs/core/tests/suite/windows_sandbox.rs
@@ -334,9 +334,7 @@ async fn windows_elevated_enforces_managed_deny_read_for_shell_subprocess() -> a
     let config_home = TempDir::new()?;
     std::fs::write(
         config_home.path().join(CONFIG_TOML_FILE),
-        r#"sandbox_mode = "workspace-write"
-
-[windows]
+        r#"[windows]
 sandbox = "elevated"
 "#,
     )?;
@@ -357,12 +355,11 @@ allowed_sandbox_implementations = ["elevated"]
 "#
     );
 
-    let mut config = load_default_config_for_test_with_cloud_config_bundle(
+    let config = load_default_config_for_test_with_cloud_config_bundle(
         &config_home,
         CloudConfigBundleFixture::loader_with_enterprise_requirement(requirements),
     )
     .await;
-    config.permissions.set_workspace_roots(vec![cwd.clone()]);
     assert_eq!(
         config.permissions.windows_sandbox_mode,
         Some(codex_config::types::WindowsSandboxModeToml::Elevated)