diff --git a/setup/provenance/README.md b/setup/provenance/README.md
index a94e73e..b072006 100644
--- a/setup/provenance/README.md
+++ b/setup/provenance/README.md
@@ -40,7 +40,7 @@ The key sources above are supported by these publisher-controlled records:
 - `https://github.com/oven-sh/bun/blob/main/dockerhub/distroless/Dockerfile`
 - `https://github.com/nodejs/node/releases/tag/v24.20.0`
 - `https://github.com/nodejs/node/blob/main/README.md`
-- `https://github.com/openai/codex/releases/tag/rust-v0.150.1`
+- `https://github.com/openai/codex/releases/tag/rust-v0.165.0`
 - `https://github.com/openai/codex/blob/main/.github/workflows/rust-release.yml`
 - `https://github.com/rustdesk/rustdesk/releases/tag/1.4.9`
 
@@ -50,8 +50,8 @@ The reviewed immutable artifact and repository URLs are:
 - `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip`
 - `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz`
 - `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz`
-- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz`
-- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz`
+- `https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz`
+- `https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz`
 - `https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm`
 - `https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpm`
 - `https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm`
@@ -72,6 +72,15 @@ record both the reviewed archive digest and this reviewed installed-byte digest
 in `.panama-provenance`; later runs require the receipt and re-hash the installed
 binary before treating an existing directory as trusted.
 
+Codex was re-reviewed on 2026-10-29 for 0.165.0. Each archive's `sha256sum`
+matched the `digest` GitHub publishes for that release asset. The installer
+accepts a Codex archive only when `tar -tzf` prints exactly the entries in
+`codex-package.listing`. Both architectures share that listing. 0.165.0 dropped
+the bundled `codex-resources/zsh/` and added `codex-resources/voice/`, and the
+archives grew past 128 MiB, so `CODEX_*_MAX_BYTES` is 256 MiB. To bump Codex,
+update `installers.conf`, regenerate the listing with `tar -tzf ARTIFACT`, and
+run `tests/setup/package-provenance-contract`.
+
 ## Panama bootstrap
 
 The public desktop and server commands use the same committed `boot` blob:
diff --git a/setup/provenance/codex-package.listing b/setup/provenance/codex-package.listing
new file mode 100644
index 0000000..206c44a
--- /dev/null
+++ b/setup/provenance/codex-package.listing
@@ -0,0 +1,51 @@
+bin/
+bin/codex
+bin/codex-code-mode-host
+codex-package.json
+codex-path/
+codex-path/rg
+codex-resources/
+codex-resources/bwrap
+codex-resources/voice/
+codex-resources/voice/NOTICE.md
+codex-resources/voice/bin/
+codex-resources/voice/bin/codex-voice-host
+codex-resources/voice/lib/
+codex-resources/voice/lib/gstreamer-1.0/
+codex-resources/voice/lib/gstreamer-1.0/libgstapp.so
+codex-resources/voice/lib/gstreamer-1.0/libgstaudioconvert.so
+codex-resources/voice/lib/gstreamer-1.0/libgstaudioresample.so
+codex-resources/voice/lib/gstreamer-1.0/libgstcoreelements.so
+codex-resources/voice/lib/gstreamer-1.0/libgstopus.so
+codex-resources/voice/lib/gstreamer-1.0/libgstrtp.so
+codex-resources/voice/lib/gstreamer-1.0/libgstrtpmanager.so
+codex-resources/voice/lib/libffi.so.8
+codex-resources/voice/lib/libgio-2.0.so.0
+codex-resources/voice/lib/libglib-2.0.so.0
+codex-resources/voice/lib/libgmodule-2.0.so.0
+codex-resources/voice/lib/libgobject-2.0.so.0
+codex-resources/voice/lib/libgstallocators-1.0.so.0
+codex-resources/voice/lib/libgstapp-1.0.so.0
+codex-resources/voice/lib/libgstaudio-1.0.so.0
+codex-resources/voice/lib/libgstbase-1.0.so.0
+codex-resources/voice/lib/libgstnet-1.0.so.0
+codex-resources/voice/lib/libgstpbutils-1.0.so.0
+codex-resources/voice/lib/libgstreamer-1.0.so.0
+codex-resources/voice/lib/libgstrtp-1.0.so.0
+codex-resources/voice/lib/libgsttag-1.0.so.0
+codex-resources/voice/lib/libgstvideo-1.0.so.0
+codex-resources/voice/lib/libintl.so.8
+codex-resources/voice/lib/libopus.so.0
+codex-resources/voice/lib/libpcre2-8.so.0
+codex-resources/voice/lib/libz.so.1
+codex-resources/voice/licenses/
+codex-resources/voice/licenses/LGPL-2.1.txt
+codex-resources/voice/licenses/Opus.txt
+codex-resources/voice/licenses/PCRE2.md
+codex-resources/voice/licenses/libffi.txt
+codex-resources/voice/licenses/proxy-libintl.txt
+codex-resources/voice/licenses/sljit.txt
+codex-resources/voice/licenses/zlib.txt
+codex-resources/voice/manifest.json
+codex-resources/voice/runtime.json
+codex-resources/voice/sources.json
diff --git a/setup/provenance/installers.conf b/setup/provenance/installers.conf
index 3701467..1edc6d3 100644
--- a/setup/provenance/installers.conf
+++ b/setup/provenance/installers.conf
@@ -16,15 +16,15 @@ NODE_AARCH64_URL=https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.
 NODE_AARCH64_SHA256=5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7
 NODE_AARCH64_BINARY_SHA256=23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477
 NODE_AARCH64_MAX_BYTES=67108864
-CODEX_VERSION=0.150.1
-CODEX_X86_64_URL=https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz
-CODEX_X86_64_SHA256=00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17
-CODEX_X86_64_BINARY_SHA256=abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386
-CODEX_X86_64_MAX_BYTES=134217728
-CODEX_AARCH64_URL=https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz
-CODEX_AARCH64_SHA256=1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639
-CODEX_AARCH64_BINARY_SHA256=7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb
-CODEX_AARCH64_MAX_BYTES=134217728
+CODEX_VERSION=0.165.0
+CODEX_X86_64_URL=https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz
+CODEX_X86_64_SHA256=e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316
+CODEX_X86_64_BINARY_SHA256=c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5
+CODEX_X86_64_MAX_BYTES=268435456
+CODEX_AARCH64_URL=https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz
+CODEX_AARCH64_SHA256=c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7
+CODEX_AARCH64_BINARY_SHA256=b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f
+CODEX_AARCH64_MAX_BYTES=268435456
 RUSTDESK_VERSION=1.4.9
 RUSTDESK_X86_64_URL=https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm
 RUSTDESK_X86_64_SHA256=eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108
diff --git a/setup/scripts/install-packages b/setup/scripts/install-packages
index 0007765..be28697 100755
--- a/setup/scripts/install-packages
+++ b/setup/scripts/install-packages
@@ -452,7 +452,9 @@ _install_codex() (
 		return 1
 	fi
 	listing="$(tar -tzf "$archive")" || { rm -rf -- "$stage"; return 1; }
-	expected_listing=$'bin/\nbin/codex\nbin/codex-code-mode-host\ncodex-package.json\ncodex-path/\ncodex-path/rg\ncodex-resources/\ncodex-resources/bwrap\ncodex-resources/zsh/\ncodex-resources/zsh/bin/\ncodex-resources/zsh/bin/zsh'
+	# The reviewed archive layout lives beside installers.conf and changes with it.
+	expected_listing="$(<"$PANAMA_PATH/setup/provenance/codex-package.listing")" \
+		|| { rm -rf -- "$stage"; return 1; }
 	[[ "$listing" == "$expected_listing" ]] || { rm -rf -- "$stage"; return 1; }
 	while IFS= read -r member; do
 		_archive_path_is_safe "$member" || { rm -rf -- "$stage"; return 1; }
diff --git a/tests/setup/package-provenance-contract b/tests/setup/package-provenance-contract
index f2d253a..853affd 100755
--- a/tests/setup/package-provenance-contract
+++ b/tests/setup/package-provenance-contract
@@ -306,11 +306,11 @@ for reviewed_value in \
     'BUN_X86_64_BINARY_SHA256 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
     'BUN_AARCH64_SHA256 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e' \
     'BUN_AARCH64_BINARY_SHA256 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
-    'CODEX_VERSION 0.150.1' \
-    'CODEX_X86_64_SHA256 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
-    'CODEX_X86_64_BINARY_SHA256 abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \
-    'CODEX_AARCH64_SHA256 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639' \
-    'CODEX_AARCH64_BINARY_SHA256 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb' \
+    'CODEX_VERSION 0.165.0' \
+    'CODEX_X86_64_SHA256 e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
+    'CODEX_X86_64_BINARY_SHA256 c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
+    'CODEX_AARCH64_SHA256 c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7' \
+    'CODEX_AARCH64_BINARY_SHA256 b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f' \
     'RUSTDESK_VERSION 1.4.9' \
     'RUSTDESK_X86_64_SHA256 eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do
     read -r name expected <<<"$reviewed_value"
@@ -373,6 +373,7 @@ cp "$repo_dir/setup/lib/artifact-provenance" "$repo_dir/setup/lib/chatgpt-packag
     "$installer_fixture/setup/lib/"
 cp "$config" "$installer_fixture/setup/provenance/installers.conf"
 cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/keys/"
+cp "$repo_dir/setup/provenance/codex-package.listing" "$installer_fixture/setup/provenance/"
 sed '/^# --- The server path/,$d' "$repo_dir/setup/scripts/install-packages" \
     > "$installer_fixture/setup/scripts/install-packages"
 
@@ -401,26 +402,23 @@ for arch_spec in \
         "$bun_top/" "$bun_top/bun")
     rm -rf -- "$artifact_root/build/$bun_top"
 
-    mkdir -p "$artifact_root/build/bin" "$artifact_root/build/codex-path" \
-        "$artifact_root/build/codex-resources/zsh/bin"
-    printf '#!/usr/bin/env bash\n# fixture %s\nprintf "codex-cli 0.150.1\\n"\n' "$machine" \
+    # Build the fixture from the reviewed listing so it always has the exact
+    # layout the installer accepts.
+    mapfile -t codex_entries < "$repo_dir/setup/provenance/codex-package.listing"
+    for entry in "${codex_entries[@]}"; do
+        if [[ "$entry" == */ ]]; then
+            mkdir -p "$artifact_root/build/$entry"
+        else
+            printf '#!/usr/bin/env bash\nprintf "package resource\\n"\n' \
+                > "$artifact_root/build/$entry"
+            chmod +x "$artifact_root/build/$entry"
+        fi
+    done
+    printf '#!/usr/bin/env bash\n# fixture %s\nprintf "codex-cli 0.165.0\\n"\n' "$machine" \
         > "$artifact_root/build/bin/codex"
     cp "$artifact_root/build/bin/codex" "$artifact_root/codex-$machine.bin"
-    printf '#!/usr/bin/env bash\nprintf "code mode host\\n"\n' \
-        > "$artifact_root/build/bin/codex-code-mode-host"
-    printf '{"target":"%s"}\n' "$machine" > "$artifact_root/build/codex-package.json"
-    for package_binary in codex-path/rg codex-resources/bwrap codex-resources/zsh/bin/zsh; do
-        printf '#!/usr/bin/env bash\nprintf "package resource\\n"\n' \
-            > "$artifact_root/build/$package_binary"
-    done
-    chmod +x "$artifact_root/build/bin/codex" \
-        "$artifact_root/build/bin/codex-code-mode-host" \
-        "$artifact_root/build/codex-path/rg" "$artifact_root/build/codex-resources/bwrap" \
-        "$artifact_root/build/codex-resources/zsh/bin/zsh"
     tar -C "$artifact_root/build" --no-recursion -czf "$artifact_root/codex-$machine.tar.gz" \
-        bin/ bin/codex bin/codex-code-mode-host codex-package.json \
-        codex-path/ codex-path/rg codex-resources/ codex-resources/bwrap \
-        codex-resources/zsh/ codex-resources/zsh/bin/ codex-resources/zsh/bin/zsh
+        "${codex_entries[@]}"
     rm -rf -- "$artifact_root/build/bin" "$artifact_root/build/codex-path" \
         "$artifact_root/build/codex-resources"
     rm -f -- "$artifact_root/build/codex-package.json"
@@ -448,7 +446,7 @@ for destination, directory_type, entry_type, content in (
 PY
 mkdir -p "$artifact_root/build/wrong-node/bin" "$artifact_root/build/wrong-codex"
 printf '#!/usr/bin/env bash\nprintf "v24.20.0\\n"\n' > "$artifact_root/build/wrong-node/bin/node"
-printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' > "$artifact_root/build/wrong-codex/codex"
+printf '#!/usr/bin/env bash\nprintf "codex-cli 0.165.0\\n"\n' > "$artifact_root/build/wrong-codex/codex"
 chmod +x "$artifact_root/build/wrong-node/bin/node" "$artifact_root/build/wrong-codex/codex"
 tar -C "$artifact_root/build" -cJf "$artifact_root/node-bad.tar.xz" wrong-node
 tar -C "$artifact_root/build" -czf "$artifact_root/codex-bad.tar.gz" wrong-codex/codex
@@ -461,7 +459,7 @@ chmod +x "$artifact_root/build/bun-linux-x64/bun"
 cp "$test_tmp/unsigned-fixture.rpm" "$artifact_root/rustdesk.rpm"
 printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "v24.20.0\\n"\n' \
     > "$artifact_root/outside-node"
-printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "codex-cli 0.150.1\\n"\n' \
+printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "codex-cli 0.165.0\\n"\n' \
     > "$artifact_root/outside-codex"
 chmod +x "$artifact_root/outside-node" "$artifact_root/outside-codex"
 node_escape_top='node-v24.20.0-linux-x64'
@@ -581,7 +579,7 @@ set -euo pipefail
 destination="${!#}"
 if [[ "${STUB_SIGNAL_PHASE:-}" == activation ]]; then
     case "$destination" in
-        */.nvm/versions/node/v24.20.0|*/.bun/versions/1.4.0|*/.local/lib/panama/codex/0.150.1)
+        */.nvm/versions/node/v24.20.0|*/.bun/versions/1.4.0|*/.local/lib/panama/codex/0.165.0)
             printf 'signal:activation\n' >> "$COMMAND_LOG"
             pgid="$(ps -o pgid= -p $$ | tr -d ' ')"
             kill -TERM -- "-$pgid"
@@ -601,7 +599,7 @@ fi
 case "${STUB_LATE_COLLISION:-}:$destination" in
     Node:*/.nvm/versions/node/v24.20.0|\
     Bun:*/.bun/versions/1.4.0|\
-    Codex:*/.local/lib/panama/codex/0.150.1)
+    Codex:*/.local/lib/panama/codex/0.165.0)
         if [[ ! -e "$destination" ]]; then
             mkdir -p -- "$destination"
             printf 'preserved collision\n' > "$destination/collision-marker"
@@ -708,7 +706,7 @@ if [[ "${STUB_TRAVERSAL_ERROR:-}" == Node ]] \
     exit 0
 elif [[ "${STUB_TRAVERSAL_ERROR:-}" == Codex ]] \
     && cmp -s "$file" "$ARTIFACT_ROOT/outside-codex"; then
-    printf '%s  %s\n' abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386 "$file"
+    printf '%s  %s\n' c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5 "$file"
     exit 0
 fi
 for spec in \
@@ -722,9 +720,9 @@ for spec in \
     'bun-symlink.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
     'bun-special.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
     'bun-directory.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
-    'codex-x86_64.tar.gz 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
-    'codex-aarch64.tar.gz 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639' \
-    'codex-bad.tar.gz 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
+    'codex-x86_64.tar.gz e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
+    'codex-aarch64.tar.gz c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7' \
+    'codex-bad.tar.gz e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
     'rustdesk.rpm eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do
     read -r fixture digest <<<"$spec"
     if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then
@@ -740,8 +738,8 @@ for binary_spec in \
     'node-aarch64.bin 23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477' \
     'bun-x86_64.bin 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
     'bun-aarch64.bin 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
-    'codex-x86_64.bin abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \
-    'codex-aarch64.bin 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb'; do
+    'codex-x86_64.bin c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
+    'codex-aarch64.bin b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f'; do
     read -r fixture digest <<<"$binary_spec"
     if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then
         printf '%s  %s\n' "$digest" "$file"
@@ -1026,6 +1024,7 @@ STUB
 reset_installer_fixture() {
     cp "$config" "$installer_fixture/setup/provenance/installers.conf"
     cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/keys/"
+    cp "$repo_dir/setup/provenance/codex-package.listing" "$installer_fixture/setup/provenance/"
 }
 
 write_flathub_descriptor() {
@@ -1086,11 +1085,11 @@ run_installer_function() {
             ln -s "$case_root/home/.bun/versions/1.4.0/bin/bun" "$case_root/home/.bun/bin/bun"
             ;;
         Codex)
-            mkdir -p "$case_root/home/.local/lib/panama/codex/0.150.1" "$case_root/home/.local/bin"
-            printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' \
-                > "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
-            chmod +x "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
-            ln -s "$case_root/home/.local/lib/panama/codex/0.150.1/codex" \
+            mkdir -p "$case_root/home/.local/lib/panama/codex/0.165.0" "$case_root/home/.local/bin"
+            printf '#!/usr/bin/env bash\nprintf "codex-cli 0.165.0\\n"\n' \
+                > "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
+            chmod +x "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
+            ln -s "$case_root/home/.local/lib/panama/codex/0.165.0/codex" \
                 "$case_root/home/.local/bin/codex"
             ;;
     esac
@@ -1108,10 +1107,10 @@ run_installer_function() {
             chmod +x "$case_root/home/.bun/versions/1.4.0/bin/bun"
             ;;
         Codex)
-            mkdir -p "$case_root/home/.local/lib/panama/codex/0.150.1"
-            printf '#!/usr/bin/env bash\nprintf "codex-cli 10.150.10\\n"\n' \
-                > "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
-            chmod +x "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
+            mkdir -p "$case_root/home/.local/lib/panama/codex/0.165.0"
+            printf '#!/usr/bin/env bash\nprintf "codex-cli 10.165.10\\n"\n' \
+                > "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
+            chmod +x "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
             ;;
     esac
     write_flathub_descriptor "$case_root/flathub.flatpakrepo" \
@@ -1308,8 +1307,8 @@ for runtime_case in \
     'node-aarch64 aarch64 install_node Node https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz 67108864' \
     'bun-x86_64 x86_64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip 67108864' \
     'bun-aarch64 aarch64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip 67108864' \
-    'codex-x86_64 x86_64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz 134217728' \
-    'codex-aarch64 aarch64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz 134217728'; do
+    'codex-x86_64 x86_64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz 268435456' \
+    'codex-aarch64 aarch64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz 268435456'; do
     read -r name arch function_name component url max_bytes <<<"$runtime_case"
     reset_installer_fixture
     if ! STUB_ARCH="$arch" run_installer_function "$name" "$function_name"; then
@@ -1329,8 +1328,8 @@ for receipt_spec in \
     'node-aarch64 .nvm/versions/node/v24.20.0 5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7 23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477' \
     'bun-x86_64 .bun/versions/1.4.0 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
     'bun-aarch64 .bun/versions/1.4.0 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
-    'codex-x86_64 .local/lib/panama/codex/0.150.1 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17 abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \
-    'codex-aarch64 .local/lib/panama/codex/0.150.1 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb'; do
+    'codex-x86_64 .local/lib/panama/codex/0.165.0 e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316 c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
+    'codex-aarch64 .local/lib/panama/codex/0.165.0 c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7 b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f'; do
     read -r name target_relative artifact_digest binary_digest <<<"$receipt_spec"
     assert_file_bytes "$test_tmp/cases/$name/home/$target_relative/.panama-provenance" \
         "$(printf 'schema=1\nartifact_sha256=%s\nbinary_sha256=%s\n' \
@@ -1365,9 +1364,9 @@ grep -qFx 'nvm:alias default 24.20.0' "$test_tmp/cases/node-x86_64/commands.log"
     "$test_tmp/cases/bun-x86_64/home/.bun/versions/1.4.0/bin/bun" ]] \
     || fail 'Bun did not atomically activate the reviewed version path'
 [[ "$($test_tmp/cases/codex-x86_64/home/.local/bin/codex --version)" == \
-    'codex-cli 0.150.1' ]] || fail 'x86_64 Codex activation has the wrong version'
+    'codex-cli 0.165.0' ]] || fail 'x86_64 Codex activation has the wrong version'
 [[ "$(readlink "$test_tmp/cases/codex-x86_64/home/.local/bin/codex")" == \
-    "$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.150.1/codex" ]] \
+    "$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.165.0/codex" ]] \
     || fail 'Codex did not atomically activate the reviewed version path'
 
 # Unsupported CPUs stop before curl. RustDesk's reviewed RPM is x86_64-only,
@@ -1391,7 +1390,7 @@ done
 for component_spec in \
     'Node install_node .nvm/versions/node/v24.20.0' \
     'Bun install_bun .bun/versions/1.4.0' \
-    'Codex install_codex .local/lib/panama/codex/0.150.1'; do
+    'Codex install_codex .local/lib/panama/codex/0.165.0'; do
     read -r component function_name target_relative <<<"$component_spec"
     name="${component,,}-late-collision"
     reset_installer_fixture
@@ -1503,7 +1502,7 @@ done
 # Successful updates keep the old version directory and switch only the active
 # symlink after the replacement binary has passed its version check.
 for component_spec in 'Bun install_bun .bun/bin/bun .bun/versions/1.4.0/bin/bun' \
-    'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.150.1/codex'; do
+    'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.165.0/codex'; do
     read -r component function_name active_relative target_relative <<<"$component_spec"
     name="${component,,}-atomic-update"
     reset_installer_fixture
@@ -1525,7 +1524,7 @@ done
 for tamper_spec in \
     'Node install_node .nvm/versions/node/v24.20.0 bin/node v24.20.0' \
     'Bun install_bun .bun/versions/1.4.0 bin/bun 1.4.0' \
-    'Codex install_codex .local/lib/panama/codex/0.150.1 codex codex-cli_0.150.1'; do
+    'Codex install_codex .local/lib/panama/codex/0.165.0 codex codex-cli_0.165.0'; do
     read -r component function_name target_relative binary_relative version_text <<<"$tamper_spec"
     for tamper_kind in receipt binary; do
         name="${component,,}-$tamper_kind-tamper"
@@ -1564,7 +1563,7 @@ done
 for layout_case in \
     'node-layout install_node Node .nvm/versions/node/v24.20.0' \
     'bun-layout install_bun Bun .bun/versions/1.4.0' \
-    'codex-layout install_codex Codex .local/lib/panama/codex/0.150.1'; do
+    'codex-layout install_codex Codex .local/lib/panama/codex/0.165.0'; do
     read -r name function_name component relative_target <<<"$layout_case"
     reset_installer_fixture
     STUB_BAD_LAYOUT=1 expect_failure run_installer_function "$name" "$function_name"