diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 2f35a543ccd3..1add11343ffa 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -1,24 +1,71 @@
 {
   lib,
-  buildNpmPackage,
+  stdenv,
   fetchFromGitHub,
+  nodejs_22, # Node ≥22 is required by codex-cli
+  pnpm_10,
+  makeBinaryWrapper,
+  installShellFiles,
   versionCheckHook,
 }:
 
-buildNpmPackage rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "codex";
-  version = "0.1.2504161510"; # from codex-cli/package.json
+  version = "0.1.2504251709"; # from codex-cli/package.json
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
-    rev = "b0ccca555685b1534a0028cb7bfdcad8fe2e477a";
-    hash = "sha256-WTnP6HZfrMjUoUZL635cngpfvvjrA2Zvm74T2627GwA=";
+    rev = "103093f79324482020490cb658cc1a696aece3bc";
+    hash = "sha256-GmMQi67HRanGKhiTKX8wgnpUbA1UwkPVe3siU4qC02Y=";
   };
 
-  sourceRoot = "${src.name}/codex-cli";
+  pnpmWorkspaces = [ "@openai/codex" ];
 
-  npmDepsHash = "sha256-riVXC7T9zgUBUazH5Wq7+MjU1FepLkp9kHLSq+ZVqbs=";
+  nativeBuildInputs = [
+    nodejs_22
+    pnpm_10.configHook
+    makeBinaryWrapper
+    installShellFiles
+  ];
+
+  pnpmDeps = pnpm_10.fetchDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      pnpmWorkspaces
+      ;
+    hash = "sha256-pPwHjtqqaG+Zqmq6x5o+WCT1H9XuXAqFNKMzevp7wTc=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+    pnpm --filter @openai/codex run build
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    dest=$out/lib/node_modules/@openai/codex
+    mkdir -p "$dest"
+    cp -r codex-cli/dist codex-cli/bin codex-cli/package.json "$dest"
+    cp LICENSE README.md "$dest"
+
+    mkdir -p $out/bin
+    makeBinaryWrapper ${nodejs_22}/bin/node $out/bin/codex --add-flags "$dest/bin/codex.js"
+
+    # Install shell completions
+    ${lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      $out/bin/codex completion bash > codex.bash
+      $out/bin/codex completion zsh > codex.zsh
+      $out/bin/codex completion fish > codex.fish
+      installShellCompletion codex.{bash,zsh,fish}
+    ''}
+
+    runHook postInstall
+  '';
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
@@ -30,4 +77,4 @@ buildNpmPackage rec {
     maintainers = [ lib.maintainers.malo ];
     mainProgram = "codex";
   };
-}
+})