diff --git a/.github/workflows/container-remediation.yml b/.github/workflows/container-remediation.yml
index 8b5bacc..d8d20e5 100644
--- a/.github/workflows/container-remediation.yml
+++ b/.github/workflows/container-remediation.yml
@@ -101,18 +101,16 @@ jobs:
         with:
           name: container-scan-report
 
-      - name: Install Claude Code CLI
-        run: |
-          curl -fsSL https://claude.ai/install.sh | bash
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+      - name: Install Codex CLI
+        run: npm install -g @openai/codex
 
       - name: Triage findings
         env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
         run: |
           curl -fsSL "https://raw.githubusercontent.com/kernel/security-workflows/${{ inputs.security-workflows-ref }}/.github/workflows/container-scan/triage-prompt.md" \
             | envsubst '${GITHUB_REPOSITORY}' \
-            | claude -p --model ${{ vars.CLAUDE_CODE_PREFERRED_MODEL }} --dangerously-skip-permissions --output-format text --verbose
+            | codex exec --model gpt-5.5 --dangerously-bypass-approvals-and-sandbox --ephemeral -
 
       - name: Upload triage results
         uses: actions/upload-artifact@v4
@@ -172,15 +170,13 @@ jobs:
         env:
           GOPRIVATE: github.com/kernel/*
 
-      - name: Install Claude Code CLI
-        run: |
-          curl -fsSL https://claude.ai/install.sh | bash
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+      - name: Install Codex CLI
+        run: npm install -g @openai/codex
 
       - name: Apply fixes
         timeout-minutes: 8
         env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           GOPRIVATE: github.com/kernel/*
           GO_MODULE_DIR: ${{ inputs.go-version-file != '' && format('{0}', inputs.go-version-file) || '.' }}
         run: |
@@ -188,7 +184,7 @@ jobs:
           export GO_MODULE_DIR="$(dirname "$GO_MODULE_DIR")"
           curl -fsSL "https://raw.githubusercontent.com/kernel/security-workflows/${{ inputs.security-workflows-ref }}/.github/workflows/container-scan/fix-prompt.md" \
             | envsubst '${GITHUB_REPOSITORY} ${DATE} ${GO_MODULE_DIR}' \
-            | claude -p --model ${{ vars.CLAUDE_CODE_PREFERRED_MODEL }} --dangerously-skip-permissions --output-format text --verbose
+            | codex exec --model gpt-5.5 --dangerously-bypass-approvals-and-sandbox --ephemeral -
 
       - name: Check for changes
         id: diff
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index ee75ee3..9704230 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -92,15 +92,13 @@ jobs:
         with:
           name: semgrep-results
 
-      - name: Install Claude Code CLI
-        run: |
-          curl -fsSL https://claude.ai/install.sh | bash
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+      - name: Install Codex CLI
+        run: npm install -g @openai/codex
 
       - name: Triage findings
         env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           export CODEBASE_DESCRIPTION="${{ inputs.codebase-description }}"
-          curl -fsSL https://raw.githubusercontent.com/kernel/security-workflows/main/.github/workflows/semgrep-triage-prompt.md | envsubst '${GITHUB_REPOSITORY} ${CODEBASE_DESCRIPTION}' | claude -p --model ${{ vars.CLAUDE_CODE_PREFERRED_MODEL }} --dangerously-skip-permissions --output-format text --verbose
+          curl -fsSL https://raw.githubusercontent.com/kernel/security-workflows/main/.github/workflows/semgrep-triage-prompt.md | envsubst '${GITHUB_REPOSITORY} ${CODEBASE_DESCRIPTION}' | codex exec --model gpt-5.5 --dangerously-bypass-approvals-and-sandbox --ephemeral -
diff --git a/.github/workflows/vuln-remediation.yml b/.github/workflows/vuln-remediation.yml
index 3026858..0e04335 100644
--- a/.github/workflows/vuln-remediation.yml
+++ b/.github/workflows/vuln-remediation.yml
@@ -264,19 +264,9 @@ jobs:
         if: steps.check.outputs.skip != 'true' && inputs.setup-python
         run: pip install uv
 
-      - name: Install Cursor CLI
+      - name: Install Codex CLI
         if: steps.check.outputs.skip != 'true'
-        run: |
-          curl https://cursor.com/install -fsS | bash
-          echo "$HOME/.cursor/bin" >> $GITHUB_PATH
-
-      - name: Enable Cursor Max Mode
-        if: steps.check.outputs.skip != 'true'
-        run: |
-          CFG_DIR="$HOME/.cursor"
-          mkdir -p "$CFG_DIR"
-          echo '{"maxMode": true}' > "$CFG_DIR/cli-config.json"
-          echo "CURSOR_CONFIG_DIR=$CFG_DIR" >> "$GITHUB_ENV"
+        run: npm install -g @openai/codex
 
       - name: Install Socket CLI
         if: steps.check.outputs.skip != 'true'
@@ -286,7 +276,7 @@ jobs:
         if: steps.check.outputs.skip != 'true'
         timeout-minutes: 10
         env:
-          CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           GOPRIVATE: github.com/kernel/*
           SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_API_TOKEN }}
         run: |
@@ -305,7 +295,7 @@ jobs:
 
           if git diff --quiet; then
             export DATE="$(date -u +%Y-%m-%d)"
-            curl -fsSL https://raw.githubusercontent.com/kernel/security-workflows/${{ inputs.security-workflows-ref }}/.github/workflows/vuln-remediation/fix-prompt.md | envsubst '${GITHUB_REPOSITORY} ${DATE}' | agent -p --model ${{ vars.CURSOR_PREFERRED_MODEL }} --workspace . --trust --force --output-format=text
+            curl -fsSL https://raw.githubusercontent.com/kernel/security-workflows/${{ inputs.security-workflows-ref }}/.github/workflows/vuln-remediation/fix-prompt.md | envsubst '${GITHUB_REPOSITORY} ${DATE}' | codex exec --model gpt-5.5 --dangerously-bypass-approvals-and-sandbox --ephemeral -
           fi
 
       - name: Validate remediation diff
diff --git a/README.md b/README.md
index 5595256..103db9e 100644
--- a/README.md
+++ b/README.md
@@ -87,14 +87,6 @@ projectIgnorePaths:
 
 Consumer repos need these secrets (set at org or repo level):
 
-- `ANTHROPIC_API_KEY` — for the `semgrep.yml` triage agent (Claude Code)
-- `CURSOR_API_KEY` — for the other fix/remediation agents (Cursor)
+- `OPENAI_API_KEY` — for GPT-5.5 triage and remediation agents (Codex)
 - `ADMIN_APP_ID` + `ADMIN_APP_PRIVATE_KEY` — GitHub App for write access
 - `SOCKET_API_TOKEN` — Socket.dev API token
-
-## Required variables
-
-Consumer repos need these variables (set at org or repo level):
-
-- `CLAUDE_CODE_PREFERRED_MODEL` — model for the `semgrep.yml` triage agent (Claude Code)
-- `CURSOR_PREFERRED_MODEL` — model for the other Cursor agent invocations