diff --git a/Dockerfile.sandbox b/Dockerfile.sandbox
index 205f9acca1..e14e25205c 100644
--- a/Dockerfile.sandbox
+++ b/Dockerfile.sandbox
@@ -144,6 +144,9 @@ RUN curl -fsSL https://claude.ai/install.sh | bash && \
     ln -s /usr/local/bin/claude /tmp/.local/bin/claude && \
     chmod 777 /tmp/.local
 
+# --- codex agent ---
+RUN npm i -g @openai/codex
+
 # Entrypoint that registers the dynamic UID in /etc/passwd so sudo works.
 # workmux passes --user UID:GID directly, bypassing network-init.sh.
 RUN cat <<'ENTRY' > /usr/local/bin/entrypoint.sh
diff --git a/dev-dashboard/backend/src/workmux.ts b/dev-dashboard/backend/src/workmux.ts
index 8957db5a69..a3b98e25d0 100644
--- a/dev-dashboard/backend/src/workmux.ts
+++ b/dev-dashboard/backend/src/workmux.ts
@@ -105,9 +105,11 @@ function buildAgentCmd(profile: Profile, env: Record<string, string>, agent: Age
 
   if (agent === "codex") {
     if (profile === "agent-yolo") {
-      return `workmux sandbox agent -- codex --yolo`;
+      const innerEscaped = prompt.replace(/["\\$`]/g, "\\$&");
+      return `workmux sandbox agent -- codex --yolo -c '"developer_instructions=${innerEscaped}"'`;
     }
-    return "codex";
+    const escapedPrompt = prompt.replace(/'/g, "'\\''");
+    return `codex -c 'developer_instructions=${escapedPrompt}'`;
   }
 
   // Claude