diff --git a/.gitignore b/.gitignore
index 36bca19..5202ddf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,7 @@
 
 # ignore
 configs/claude/**
+configs/codex/**
 
 # keep
 !configs/claude/CLAUDE.md
@@ -9,6 +10,9 @@ configs/claude/**
 !configs/claude/skills/
 !configs/claude/skills/**
 !configs/claude/statusline-command.sh
+!configs/codex/
+!configs/codex/AGENTS.md
+!configs/codex/config.toml
 
 # Generated symlinks from link-dotfiles.sh for hostname-specific skills.
 # Add an entry here for each skill that lives under configs/personal/ or configs/work/.
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c0007b1..b9d9a51 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -5,3 +5,11 @@ repos:
       - id: shellcheck
         files: ^(configs/(aliases|bash_profile|zprofile|zshrc)|scripts/.*\.sh)$
         types: [file]
+  - repo: local
+    hooks:
+      - id: codex-doctor
+        name: codex doctor
+        entry: codex doctor --summary --ascii
+        language: system
+        pass_filenames: false
+        files: ^configs/codex/config\.toml$
diff --git a/Brewfile b/Brewfile
index 10a6a0d..07cb439 100644
--- a/Brewfile
+++ b/Brewfile
@@ -58,9 +58,10 @@ cask '1password-cli'
 cask 'appzapper'
 cask 'claude'
 cask 'claude-code'
+cask 'codex'
 cask 'gcloud-cli'
 cask 'ghostty'
-cask 'linear-linear'
+cask 'linear'
 cask 'font-jetbrains-mono-nerd-font'
 cask 'podman-desktop'
 cask 'spotify'
diff --git a/README.md b/README.md
index 0aba547..44d3a80 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,7 @@ scripts/
 configs/                  # Dotfiles and tool configs
   AGENTS.md               # Shared global agent instructions
   agents/                 # Shared user-level agent config
+  codex/                  # Codex config
 Brewfile                  # Common Homebrew packages
 Brewfile.work             # Work-specific packages
 Brewfile.personal         # Personal-specific packages
diff --git a/configs/codex/AGENTS.md b/configs/codex/AGENTS.md
new file mode 120000
index 0000000..be77ac8
--- /dev/null
+++ b/configs/codex/AGENTS.md
@@ -0,0 +1 @@
+../AGENTS.md
\ No newline at end of file
diff --git a/configs/codex/config.toml b/configs/codex/config.toml
new file mode 100644
index 0000000..acc52c0
--- /dev/null
+++ b/configs/codex/config.toml
@@ -0,0 +1,10 @@
+status_line = ["model-with-reasoning", "context-remaining", "git-branch", "current-dir"]
+sandbox_mode = "workspace-write"
+approval_policy = "on-request"
+approvals_reviewer = "auto_review"
+
+[projects."~/code"]
+trust_level = "trusted"
+
+[tui.model_availability_nux]
+"gpt-5.5" = 3
diff --git a/scripts/link-dotfiles.sh b/scripts/link-dotfiles.sh
index 8646b12..a1d07c8 100755
--- a/scripts/link-dotfiles.sh
+++ b/scripts/link-dotfiles.sh
@@ -28,6 +28,29 @@ link_file() {
   echo "  linked:         $dest -> $src"
 }
 
+migrate_directory_contents() {
+  local src="$1"
+  local dest="$2"
+
+  if [ ! -d "$dest" ] || [ -L "$dest" ]; then
+    return
+  fi
+
+  echo "  migrating:      $dest contents -> $src"
+  for path in "$dest"/* "$dest"/.[!.]* "$dest"/..?*; do
+    [ -e "$path" ] || continue
+    local name
+    name="$(basename "$path")"
+
+    if [ -e "$src/$name" ] || [ -L "$src/$name" ]; then
+      echo "    keeping managed Codex entry: $name"
+      continue
+    fi
+
+    mv "$path" "$src/$name"
+  done
+}
+
 echo "Linking dotfiles ..."
 
 link_file "$CONFIGS_DIR/zshrc"             "$HOME/.zshrc"
@@ -43,11 +66,12 @@ link_file "$CONFIGS_DIR/gemrc"             "$HOME/.gemrc"
 link_file "$CONFIGS_DIR/tmux.conf"         "$HOME/.tmux.conf"
 link_file "$CONFIGS_DIR/nvim"              "$HOME/.config/nvim"
 
-echo "Linking Codex global instructions ..."
+echo "Linking Codex config ..."
 
 CODEX_HOME_DIR="${CODEX_HOME:-$HOME/.codex}"
-mkdir -p "$CODEX_HOME_DIR"
-link_file "$CONFIGS_DIR/AGENTS.md" "$CODEX_HOME_DIR/AGENTS.md"
+mkdir -p "$(dirname "$CODEX_HOME_DIR")"
+migrate_directory_contents "$CONFIGS_DIR/codex" "$CODEX_HOME_DIR"
+link_file "$CONFIGS_DIR/codex" "$CODEX_HOME_DIR"
 
 echo "Linking claude config ..."