diff --git a/codex-rs/core/src/exec.rs b/codex-rs/core/src/exec.rs
index a6d958b107..3206450af8 100644
--- a/codex-rs/core/src/exec.rs
+++ b/codex-rs/core/src/exec.rs
@@ -115,12 +115,11 @@ pub(crate) struct WindowsSandboxFilesystemOverrides {
 
 fn windows_sandbox_uses_elevated_backend(
     sandbox_level: WindowsSandboxLevel,
-    proxy_enforced: bool,
+    _proxy_enforced: bool,
 ) -> bool {
-    // Windows firewall enforcement is tied to the logon-user sandbox identities, so
-    // proxy-enforced sessions must use that backend even when the configured mode is
-    // the default restricted-token sandbox.
-    proxy_enforced || matches!(sandbox_level, WindowsSandboxLevel::Elevated)
+    // Honor the configured Windows sandbox mode instead of silently upgrading
+    // restricted-token sessions onto the elevated setup path.
+    matches!(sandbox_level, WindowsSandboxLevel::Elevated)
 }
 
 #[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
diff --git a/codex-rs/core/src/exec_tests.rs b/codex-rs/core/src/exec_tests.rs
index 23db019bb9..cb5b3bf953 100644
--- a/codex-rs/core/src/exec_tests.rs
+++ b/codex-rs/core/src/exec_tests.rs
@@ -409,12 +409,12 @@ fn windows_restricted_token_runs_for_legacy_restricted_policies() {
 }
 
 #[test]
-fn windows_proxy_enforcement_uses_elevated_backend() {
+fn windows_restricted_token_mode_stays_unelevated_when_proxy_is_enforced() {
     assert!(!windows_sandbox_uses_elevated_backend(
         WindowsSandboxLevel::RestrictedToken,
         /*proxy_enforced*/ false,
     ));
-    assert!(windows_sandbox_uses_elevated_backend(
+    assert!(!windows_sandbox_uses_elevated_backend(
         WindowsSandboxLevel::RestrictedToken,
         /*proxy_enforced*/ true,
     ));