diff --git a/apps/server/src/providers/codex-provider.ts b/apps/server/src/providers/codex-provider.ts
index db237424..fbd96b45 100644
--- a/apps/server/src/providers/codex-provider.ts
+++ b/apps/server/src/providers/codex-provider.ts
@@ -743,13 +743,17 @@ export class CodexProvider extends BaseProvider {
         overrides.push({ key: CODEX_REASONING_EFFORT_KEY, value: options.reasoningEffort });
       }
 
+      // Add approval policy
+      overrides.push({ key: 'approval_policy', value: approvalPolicy });
+
+      // Add web search if enabled
+      if (searchEnabled) {
+        overrides.push({ key: 'features.web_search_request', value: true });
+      }
+
       const configOverrides = buildConfigOverrides(overrides);
       const preExecArgs: string[] = [];
 
-      if (searchEnabled) {
-        preExecArgs.push(CODEX_SEARCH_FLAG);
-      }
-
       // Add additional directories with write access
       if (codexSettings.additionalDirs && codexSettings.additionalDirs.length > 0) {
         for (const dir of codexSettings.additionalDirs) {
@@ -760,8 +764,6 @@ export class CodexProvider extends BaseProvider {
       const args = [
         CODEX_EXEC_SUBCOMMAND,
         CODEX_SKIP_GIT_REPO_CHECK_FLAG,
-        CODEX_APPROVAL_FLAG,
-        approvalPolicy,
         ...preExecArgs,
         CODEX_MODEL_FLAG,
         options.model,
diff --git a/apps/server/tests/unit/providers/codex-provider.test.ts b/apps/server/tests/unit/providers/codex-provider.test.ts
index fd981458..7e798b8a 100644
--- a/apps/server/tests/unit/providers/codex-provider.test.ts
+++ b/apps/server/tests/unit/providers/codex-provider.test.ts
@@ -187,15 +187,19 @@ describe('codex-provider.ts', () => {
       );
 
       const call = vi.mocked(spawnJSONLProcess).mock.calls[0][0];
-      const approvalIndex = call.args.indexOf('--ask-for-approval');
+      const approvalConfigIndex = call.args.indexOf('--config');
       const execIndex = call.args.indexOf(EXEC_SUBCOMMAND);
-      const searchIndex = call.args.indexOf('--search');
-      expect(call.args[approvalIndex + 1]).toBe('never');
-      expect(approvalIndex).toBeGreaterThan(-1);
+      const searchConfigIndex = call.args.indexOf('--config');
+      expect(call.args[approvalConfigIndex + 1]).toBe('approval_policy=never');
+      expect(approvalConfigIndex).toBeGreaterThan(-1);
       expect(execIndex).toBeGreaterThan(-1);
-      expect(approvalIndex).toBeGreaterThan(execIndex);
-      expect(searchIndex).toBeGreaterThan(-1);
-      expect(searchIndex).toBeGreaterThan(execIndex);
+      expect(approvalConfigIndex).toBeGreaterThan(execIndex);
+      // Search should be in config, not as direct flag
+      const hasSearchConfig = call.args.some(
+        (arg, index) =>
+          arg === '--config' && call.args[index + 1] === 'features.web_search_request=true'
+      );
+      expect(hasSearchConfig).toBe(true);
     });
 
     it('injects user and project instructions when auto-load is enabled', async () => {