diff --git a/codex-rs/exec/src/cli.rs b/codex-rs/exec/src/cli.rs
index b6c48b9d..31dd4109 100644
--- a/codex-rs/exec/src/cli.rs
+++ b/codex-rs/exec/src/cli.rs
@@ -19,7 +19,7 @@ pub struct Cli {
 
     /// Select the sandbox policy to use when executing model-generated shell
     /// commands.
-    #[arg(long = "sandbox", short = 's')]
+    #[arg(long = "sandbox", short = 's', value_enum)]
     pub sandbox_mode: Option<codex_common::SandboxModeCliArg>,
 
     /// Configuration profile from config.toml to specify default options.