diff --git a/codex-rs/cli/src/lib.rs b/codex-rs/cli/src/lib.rs
index 1c0a2e7e0251..c008567b96a8 100644
--- a/codex-rs/cli/src/lib.rs
+++ b/codex-rs/cli/src/lib.rs
@@ -53,7 +53,12 @@ pub struct SeatbeltCommand {
     pub sandbox_state: SandboxStateArgs,
 
     /// Named permissions profile to apply from the active configuration stack.
-    #[arg(long = "permissions-profile", short = 'P', value_name = "NAME")]
+    #[arg(
+        long = "permission-profile",
+        alias = "permissions-profile",
+        short = 'P',
+        value_name = "NAME"
+    )]
     pub permissions_profile: Option<String>,
 
     /// Layer $CODEX_HOME/<name>.config.toml on top of the base user config.
@@ -104,7 +109,12 @@ pub struct LandlockCommand {
     pub sandbox_state: SandboxStateArgs,
 
     /// Named permissions profile to apply from the active configuration stack.
-    #[arg(long = "permissions-profile", short = 'P', value_name = "NAME")]
+    #[arg(
+        long = "permission-profile",
+        alias = "permissions-profile",
+        short = 'P',
+        value_name = "NAME"
+    )]
     pub permissions_profile: Option<String>,
 
     /// Layer $CODEX_HOME/<name>.config.toml on top of the base user config.
@@ -142,7 +152,12 @@ pub struct WindowsCommand {
     pub sandbox_state: SandboxStateArgs,
 
     /// Named permissions profile to apply from the active configuration stack.
-    #[arg(long = "permissions-profile", short = 'P', value_name = "NAME")]
+    #[arg(
+        long = "permission-profile",
+        alias = "permissions-profile",
+        short = 'P',
+        value_name = "NAME"
+    )]
     pub permissions_profile: Option<String>,
 
     /// Layer $CODEX_HOME/<name>.config.toml on top of the base user config.
diff --git a/codex-rs/cli/src/main.rs b/codex-rs/cli/src/main.rs
index 959ec3a3b3bf..1d710b6c6a19 100644
--- a/codex-rs/cli/src/main.rs
+++ b/codex-rs/cli/src/main.rs
@@ -2965,7 +2965,28 @@ mod tests {
 
     #[cfg(any(target_os = "macos", target_os = "linux", target_os = "windows"))]
     #[test]
-    fn sandbox_parses_permissions_profile() {
+    fn sandbox_parses_permission_profile() {
+        let cli = MultitoolCli::try_parse_from([
+            "codex",
+            "sandbox",
+            "--permission-profile",
+            ":workspace",
+            "--",
+            "echo",
+        ])
+        .expect("parse");
+
+        let Some(Subcommand::Sandbox(command)) = cli.subcommand else {
+            panic!("expected sandbox command");
+        };
+
+        assert_eq!(command.permissions_profile.as_deref(), Some(":workspace"));
+        assert_eq!(command.command, vec!["echo"]);
+    }
+
+    #[cfg(any(target_os = "macos", target_os = "linux", target_os = "windows"))]
+    #[test]
+    fn sandbox_parses_legacy_permissions_profile_alias() {
         let cli = MultitoolCli::try_parse_from([
             "codex",
             "sandbox",
@@ -2984,6 +3005,14 @@ mod tests {
         assert_eq!(command.command, vec!["echo"]);
     }
 
+    #[cfg(any(target_os = "macos", target_os = "linux", target_os = "windows"))]
+    #[test]
+    fn sandbox_help_only_shows_singular_permission_profile() {
+        let help = help_from_args(&["codex", "sandbox", "--help"]);
+        assert!(help.contains("--permission-profile"), "{help}");
+        assert!(!help.contains("--permissions-profile"), "{help}");
+    }
+
     #[cfg(any(target_os = "macos", target_os = "linux", target_os = "windows"))]
     #[test]
     fn sandbox_parses_permissions_profile_short_alias() {
diff --git a/codex-rs/cli/tests/sandbox_network_proxy.rs b/codex-rs/cli/tests/sandbox_network_proxy.rs
index 22bdcce49d88..9ec101468811 100644
--- a/codex-rs/cli/tests/sandbox_network_proxy.rs
+++ b/codex-rs/cli/tests/sandbox_network_proxy.rs
@@ -35,7 +35,7 @@ mode = "full"
         .env("CODEX_HOME", codex_home.path())
         .args([
             "sandbox",
-            "--permissions-profile",
+            "--permission-profile",
             "network-test",
             "--",
             "curl",