diff --git a/.github/workflows/evals-marathon.yml b/.github/workflows/evals-marathon.yml
index 9aa0ba98c..153ab716b 100644
--- a/.github/workflows/evals-marathon.yml
+++ b/.github/workflows/evals-marathon.yml
@@ -129,7 +129,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       fail-fast: false
       max-parallel: 8
diff --git a/.github/workflows/evals-periodic.yml b/.github/workflows/evals-periodic.yml
index 2cfcfdb2e..dbbe273ba 100644
--- a/.github/workflows/evals-periodic.yml
+++ b/.github/workflows/evals-periodic.yml
@@ -161,7 +161,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       fail-fast: false
       # Every planned slice starts at once; test/evals-workflow-wiring.test.ts
@@ -299,7 +301,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       # Two file workers per slice, each retaining two in-file case workers.
       fail-fast: false
diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml
index 82dfaecbc..a7ce50145 100644
--- a/.github/workflows/evals.yml
+++ b/.github/workflows/evals.yml
@@ -222,7 +222,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       fail-fast: false
       max-parallel: 16
diff --git a/test/ci-native-evidence.test.ts b/test/ci-native-evidence.test.ts
index 3d1b2ed3a..38762b1c8 100644
--- a/test/ci-native-evidence.test.ts
+++ b/test/ci-native-evidence.test.ts
@@ -27,7 +27,8 @@ test('every direct CI paid executor binds a safe unique run/attempt/job/slice id
   ]);
   const ids = new Set<string>();
   for (const [workflowIndex, { job, step }] of executors.entries()) {
-    expect(job.container.options).toBe('--user runner');
+    // Non-root, and Codex's bubblewrap sandbox can create user namespaces (periodic run 37151477069).
+    expect(job.container.options).toBe('--user runner --security-opt seccomp=unconfined');
     const env = { ...job.env, ...step.env };
     expect(env.EVALS_RUN_ID).toBeString();
     for (const run of ['36302678692', '36302678693']) {