diff --git a/codex-rs/app-server-protocol/src/protocol.rs b/codex-rs/app-server-protocol/src/protocol.rs
index 74ad15f6..28e7ec50 100644
--- a/codex-rs/app-server-protocol/src/protocol.rs
+++ b/codex-rs/app-server-protocol/src/protocol.rs
@@ -767,7 +767,7 @@ pub struct Tools {
     pub view_image: Option<bool>,
 }
 
-/// MCP representation of a [`codex_core::config_types::SandboxWorkspaceWrite`].
+/// MCP representation of a [`codex_core::config::types::SandboxWorkspaceWrite`].
 #[derive(Deserialize, Debug, Clone, PartialEq, Serialize, JsonSchema, TS)]
 #[ts(optional_fields = nullable)]
 #[serde(rename_all = "camelCase")]
diff --git a/codex-rs/app-server/src/codex_message_processor.rs b/codex-rs/app-server/src/codex_message_processor.rs
index eb895820..f28d9c6a 100644
--- a/codex-rs/app-server/src/codex_message_processor.rs
+++ b/codex-rs/app-server/src/codex_message_processor.rs
@@ -73,8 +73,8 @@ use codex_core::auth::login_with_api_key;
 use codex_core::config::Config;
 use codex_core::config::ConfigOverrides;
 use codex_core::config::ConfigToml;
-use codex_core::config::load_config_as_toml;
-use codex_core::config_edit::ConfigEditsBuilder;
+use codex_core::config::edit::ConfigEditsBuilder;
+use codex_core::config_loader::load_config_as_toml;
 use codex_core::default_client::get_codex_user_agent;
 use codex_core::exec::ExecParams;
 use codex_core::exec_env::create_env;
diff --git a/codex-rs/cli/src/mcp_cmd.rs b/codex-rs/cli/src/mcp_cmd.rs
index 96a0759e..65c459a3 100644
--- a/codex-rs/cli/src/mcp_cmd.rs
+++ b/codex-rs/cli/src/mcp_cmd.rs
@@ -9,11 +9,11 @@ use codex_common::CliConfigOverrides;
 use codex_common::format_env_display::format_env_display;
 use codex_core::config::Config;
 use codex_core::config::ConfigOverrides;
+use codex_core::config::edit::ConfigEditsBuilder;
 use codex_core::config::find_codex_home;
 use codex_core::config::load_global_mcp_servers;
-use codex_core::config_edit::ConfigEditsBuilder;
-use codex_core::config_types::McpServerConfig;
-use codex_core::config_types::McpServerTransportConfig;
+use codex_core::config::types::McpServerConfig;
+use codex_core::config::types::McpServerTransportConfig;
 use codex_core::features::Feature;
 use codex_core::mcp::auth::compute_auth_statuses;
 use codex_core::protocol::McpAuthStatus;
diff --git a/codex-rs/cli/tests/mcp_add_remove.rs b/codex-rs/cli/tests/mcp_add_remove.rs
index 7a6c2daa..29116373 100644
--- a/codex-rs/cli/tests/mcp_add_remove.rs
+++ b/codex-rs/cli/tests/mcp_add_remove.rs
@@ -2,7 +2,7 @@ use std::path::Path;
 
 use anyhow::Result;
 use codex_core::config::load_global_mcp_servers;
-use codex_core::config_types::McpServerTransportConfig;
+use codex_core::config::types::McpServerTransportConfig;
 use predicates::str::contains;
 use pretty_assertions::assert_eq;
 use tempfile::TempDir;
diff --git a/codex-rs/cli/tests/mcp_list.rs b/codex-rs/cli/tests/mcp_list.rs
index 2293e701..1492365a 100644
--- a/codex-rs/cli/tests/mcp_list.rs
+++ b/codex-rs/cli/tests/mcp_list.rs
@@ -1,9 +1,9 @@
 use std::path::Path;
 
 use anyhow::Result;
+use codex_core::config::edit::ConfigEditsBuilder;
 use codex_core::config::load_global_mcp_servers;
-use codex_core::config_edit::ConfigEditsBuilder;
-use codex_core::config_types::McpServerTransportConfig;
+use codex_core::config::types::McpServerTransportConfig;
 use predicates::prelude::PredicateBooleanExt;
 use predicates::str::contains;
 use pretty_assertions::assert_eq;
diff --git a/codex-rs/core/src/codex.rs b/codex-rs/core/src/codex.rs
index f1d040b2..f1cbefe2 100644
--- a/codex-rs/core/src/codex.rs
+++ b/codex-rs/core/src/codex.rs
@@ -56,8 +56,8 @@ use crate::client::ModelClient;
 use crate::client_common::Prompt;
 use crate::client_common::ResponseEvent;
 use crate::config::Config;
-use crate::config_types::McpServerTransportConfig;
-use crate::config_types::ShellEnvironmentPolicy;
+use crate::config::types::McpServerTransportConfig;
+use crate::config::types::ShellEnvironmentPolicy;
 use crate::conversation_history::ConversationHistory;
 use crate::environment_context::EnvironmentContext;
 use crate::error::CodexErr;
@@ -2277,8 +2277,8 @@ mod tests {
     use super::*;
     use crate::config::ConfigOverrides;
     use crate::config::ConfigToml;
-    use crate::config_types::McpServerConfig;
-    use crate::config_types::McpServerTransportConfig;
+    use crate::config::types::McpServerConfig;
+    use crate::config::types::McpServerTransportConfig;
     use crate::exec::ExecToolCallOutput;
     use crate::mcp::auth::McpAuthStatusEntry;
     use crate::tools::format_exec_output_str;
diff --git a/codex-rs/core/src/config_edit.rs b/codex-rs/core/src/config/edit.rs
similarity index 99%
rename from codex-rs/core/src/config_edit.rs
rename to codex-rs/core/src/config/edit.rs
index 38419fb5..c8e3bfc3 100644
--- a/codex-rs/core/src/config_edit.rs
+++ b/codex-rs/core/src/config/edit.rs
@@ -1,6 +1,6 @@
 use crate::config::CONFIG_TOML_FILE;
-use crate::config_types::McpServerConfig;
-use crate::config_types::Notice;
+use crate::config::types::McpServerConfig;
+use crate::config::types::Notice;
 use anyhow::Context;
 use codex_protocol::config_types::ReasoningEffort;
 use std::collections::BTreeMap;
@@ -41,8 +41,8 @@ pub enum ConfigEdit {
 
 // TODO(jif) move to a dedicated file
 mod document_helpers {
-    use crate::config_types::McpServerConfig;
-    use crate::config_types::McpServerTransportConfig;
+    use crate::config::types::McpServerConfig;
+    use crate::config::types::McpServerTransportConfig;
     use toml_edit::Array as TomlArray;
     use toml_edit::InlineTable;
     use toml_edit::Item as TomlItem;
@@ -509,7 +509,7 @@ impl ConfigEditsBuilder {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::config_types::McpServerTransportConfig;
+    use crate::config::types::McpServerTransportConfig;
     use codex_protocol::config_types::ReasoningEffort;
     use pretty_assertions::assert_eq;
     use tempfile::tempdir;
diff --git a/codex-rs/core/src/config.rs b/codex-rs/core/src/config/mod.rs
similarity index 98%
rename from codex-rs/core/src/config.rs
rename to codex-rs/core/src/config/mod.rs
index c2510dc7..3759a3ad 100644
--- a/codex-rs/core/src/config.rs
+++ b/codex-rs/core/src/config/mod.rs
@@ -1,23 +1,22 @@
 use crate::auth::AuthCredentialsStoreMode;
+use crate::config::types::DEFAULT_OTEL_ENVIRONMENT;
+use crate::config::types::History;
+use crate::config::types::McpServerConfig;
+use crate::config::types::Notice;
+use crate::config::types::Notifications;
+use crate::config::types::OtelConfig;
+use crate::config::types::OtelConfigToml;
+use crate::config::types::OtelExporterKind;
+use crate::config::types::ReasoningSummaryFormat;
+use crate::config::types::SandboxWorkspaceWrite;
+use crate::config::types::ShellEnvironmentPolicy;
+use crate::config::types::ShellEnvironmentPolicyToml;
+use crate::config::types::Tui;
+use crate::config::types::UriBasedFileOpener;
 use crate::config_loader::LoadedConfigLayers;
-pub use crate::config_loader::load_config_as_toml;
+use crate::config_loader::load_config_as_toml;
 use crate::config_loader::load_config_layers_with_overrides;
 use crate::config_loader::merge_toml_values;
-use crate::config_profile::ConfigProfile;
-use crate::config_types::DEFAULT_OTEL_ENVIRONMENT;
-use crate::config_types::History;
-use crate::config_types::McpServerConfig;
-use crate::config_types::Notice;
-use crate::config_types::Notifications;
-use crate::config_types::OtelConfig;
-use crate::config_types::OtelConfigToml;
-use crate::config_types::OtelExporterKind;
-use crate::config_types::ReasoningSummaryFormat;
-use crate::config_types::SandboxWorkspaceWrite;
-use crate::config_types::ShellEnvironmentPolicy;
-use crate::config_types::ShellEnvironmentPolicyToml;
-use crate::config_types::Tui;
-use crate::config_types::UriBasedFileOpener;
 use crate::features::Feature;
 use crate::features::FeatureOverrides;
 use crate::features::Features;
@@ -51,9 +50,14 @@ use std::io::ErrorKind;
 use std::path::Path;
 use std::path::PathBuf;
 
+use crate::config::profile::ConfigProfile;
 use toml::Value as TomlValue;
 use toml_edit::DocumentMut;
 
+pub mod edit;
+pub mod profile;
+pub mod types;
+
 #[cfg(target_os = "windows")]
 pub const OPENAI_DEFAULT_MODEL: &str = "gpt-5";
 #[cfg(not(target_os = "windows"))]
@@ -265,7 +269,7 @@ pub struct Config {
     pub disable_paste_burst: bool,
 
     /// OTEL configuration (exporter type, endpoint, headers, etc.).
-    pub otel: crate::config_types::OtelConfig,
+    pub otel: crate::config::types::OtelConfig,
 }
 
 impl Config {
@@ -448,7 +452,7 @@ pub(crate) fn set_project_trusted_inner(
 /// Patch `CODEX_HOME/config.toml` project state.
 /// Use with caution.
 pub fn set_project_trusted(codex_home: &Path, project_path: &Path) -> anyhow::Result<()> {
-    use crate::config_edit::ConfigEditsBuilder;
+    use crate::config::edit::ConfigEditsBuilder;
 
     ConfigEditsBuilder::new(codex_home)
         .set_project_trusted(project_path)
@@ -629,13 +633,13 @@ pub struct ConfigToml {
     pub disable_paste_burst: Option<bool>,
 
     /// OTEL configuration.
-    pub otel: Option<crate::config_types::OtelConfigToml>,
+    pub otel: Option<crate::config::types::OtelConfigToml>,
 
     /// Tracks whether the Windows onboarding screen has been acknowledged.
     pub windows_wsl_setup_acknowledged: Option<bool>,
 
     /// Collection of in-product notices (different from notifications)
-    /// See [`crate::config_types::Notices`] for more details
+    /// See [`crate::config::types::Notices`] for more details
     pub notice: Option<Notice>,
 
     /// Legacy, now use features
@@ -1244,12 +1248,12 @@ pub fn log_dir(cfg: &Config) -> std::io::Result<PathBuf> {
 
 #[cfg(test)]
 mod tests {
-    use crate::config_edit::ConfigEdit;
-    use crate::config_edit::ConfigEditsBuilder;
-    use crate::config_edit::apply_blocking;
-    use crate::config_types::HistoryPersistence;
-    use crate::config_types::McpServerTransportConfig;
-    use crate::config_types::Notifications;
+    use crate::config::edit::ConfigEdit;
+    use crate::config::edit::ConfigEditsBuilder;
+    use crate::config::edit::apply_blocking;
+    use crate::config::types::HistoryPersistence;
+    use crate::config::types::McpServerTransportConfig;
+    use crate::config::types::Notifications;
     use crate::features::Feature;
 
     use super::*;
@@ -3174,7 +3178,7 @@ trust_level = "trusted"
 
 #[cfg(test)]
 mod notifications_tests {
-    use crate::config_types::Notifications;
+    use crate::config::types::Notifications;
     use assert_matches::assert_matches;
     use serde::Deserialize;
 
diff --git a/codex-rs/core/src/config_profile.rs b/codex-rs/core/src/config/profile.rs
similarity index 100%
rename from codex-rs/core/src/config_profile.rs
rename to codex-rs/core/src/config/profile.rs
diff --git a/codex-rs/core/src/config_types.rs b/codex-rs/core/src/config/types.rs
similarity index 100%
rename from codex-rs/core/src/config_types.rs
rename to codex-rs/core/src/config/types.rs
diff --git a/codex-rs/core/src/exec_env.rs b/codex-rs/core/src/exec_env.rs
index 88246b06..11334896 100644
--- a/codex-rs/core/src/exec_env.rs
+++ b/codex-rs/core/src/exec_env.rs
@@ -1,6 +1,6 @@
-use crate::config_types::EnvironmentVariablePattern;
-use crate::config_types::ShellEnvironmentPolicy;
-use crate::config_types::ShellEnvironmentPolicyInherit;
+use crate::config::types::EnvironmentVariablePattern;
+use crate::config::types::ShellEnvironmentPolicy;
+use crate::config::types::ShellEnvironmentPolicyInherit;
 use std::collections::HashMap;
 use std::collections::HashSet;
 
@@ -71,7 +71,7 @@ where
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::config_types::ShellEnvironmentPolicyInherit;
+    use crate::config::types::ShellEnvironmentPolicyInherit;
     use maplit::hashmap;
 
     fn make_vars(pairs: &[(&str, &str)]) -> Vec<(String, String)> {
diff --git a/codex-rs/core/src/features.rs b/codex-rs/core/src/features.rs
index 24c00aa2..0c4356d7 100644
--- a/codex-rs/core/src/features.rs
+++ b/codex-rs/core/src/features.rs
@@ -6,7 +6,7 @@
 //! container attached to `Config`.
 
 use crate::config::ConfigToml;
-use crate::config_profile::ConfigProfile;
+use crate::config::profile::ConfigProfile;
 use serde::Deserialize;
 use std::collections::BTreeMap;
 use std::collections::BTreeSet;
diff --git a/codex-rs/core/src/lib.rs b/codex-rs/core/src/lib.rs
index f853ea87..b9bd97ca 100644
--- a/codex-rs/core/src/lib.rs
+++ b/codex-rs/core/src/lib.rs
@@ -17,10 +17,7 @@ pub use codex_conversation::CodexConversation;
 mod codex_delegate;
 mod command_safety;
 pub mod config;
-pub mod config_edit;
 pub mod config_loader;
-pub mod config_profile;
-pub mod config_types;
 mod conversation_history;
 pub mod custom_prompts;
 mod environment_context;
diff --git a/codex-rs/core/src/mcp/auth.rs b/codex-rs/core/src/mcp/auth.rs
index 8718898e..e321a857 100644
--- a/codex-rs/core/src/mcp/auth.rs
+++ b/codex-rs/core/src/mcp/auth.rs
@@ -7,8 +7,8 @@ use codex_rmcp_client::determine_streamable_http_auth_status;
 use futures::future::join_all;
 use tracing::warn;
 
-use crate::config_types::McpServerConfig;
-use crate::config_types::McpServerTransportConfig;
+use crate::config::types::McpServerConfig;
+use crate::config::types::McpServerTransportConfig;
 
 #[derive(Debug, Clone)]
 pub struct McpAuthStatusEntry {
diff --git a/codex-rs/core/src/mcp_connection_manager.rs b/codex-rs/core/src/mcp_connection_manager.rs
index ebe17d2c..11a73c0b 100644
--- a/codex-rs/core/src/mcp_connection_manager.rs
+++ b/codex-rs/core/src/mcp_connection_manager.rs
@@ -37,8 +37,8 @@ use tokio::task::JoinSet;
 use tracing::info;
 use tracing::warn;
 
-use crate::config_types::McpServerConfig;
-use crate::config_types::McpServerTransportConfig;
+use crate::config::types::McpServerConfig;
+use crate::config::types::McpServerTransportConfig;
 
 /// Delimiter used to separate the server name from the tool name in a fully
 /// qualified tool name.
diff --git a/codex-rs/core/src/message_history.rs b/codex-rs/core/src/message_history.rs
index d102b2ef..e96d8d50 100644
--- a/codex-rs/core/src/message_history.rs
+++ b/codex-rs/core/src/message_history.rs
@@ -28,7 +28,7 @@ use tokio::fs;
 use tokio::io::AsyncReadExt;
 
 use crate::config::Config;
-use crate::config_types::HistoryPersistence;
+use crate::config::types::HistoryPersistence;
 
 use codex_protocol::ConversationId;
 #[cfg(unix)]
diff --git a/codex-rs/core/src/model_family.rs b/codex-rs/core/src/model_family.rs
index 76ed81b0..d6da1b05 100644
--- a/codex-rs/core/src/model_family.rs
+++ b/codex-rs/core/src/model_family.rs
@@ -1,4 +1,4 @@
-use crate::config_types::ReasoningSummaryFormat;
+use crate::config::types::ReasoningSummaryFormat;
 use crate::tools::handlers::apply_patch::ApplyPatchToolType;
 
 /// The `instructions` field in the payload sent to a model should always start
diff --git a/codex-rs/core/src/otel_init.rs b/codex-rs/core/src/otel_init.rs
index e7175edc..5931d7ca 100644
--- a/codex-rs/core/src/otel_init.rs
+++ b/codex-rs/core/src/otel_init.rs
@@ -1,6 +1,6 @@
 use crate::config::Config;
-use crate::config_types::OtelExporterKind as Kind;
-use crate::config_types::OtelHttpProtocol as Protocol;
+use crate::config::types::OtelExporterKind as Kind;
+use crate::config::types::OtelHttpProtocol as Protocol;
 use crate::default_client::originator;
 use codex_otel::config::OtelExporter;
 use codex_otel::config::OtelHttpProtocol;
diff --git a/codex-rs/core/tests/suite/rmcp_client.rs b/codex-rs/core/tests/suite/rmcp_client.rs
index 85698e92..672633ac 100644
--- a/codex-rs/core/tests/suite/rmcp_client.rs
+++ b/codex-rs/core/tests/suite/rmcp_client.rs
@@ -8,8 +8,8 @@ use std::time::Duration;
 use std::time::SystemTime;
 use std::time::UNIX_EPOCH;
 
-use codex_core::config_types::McpServerConfig;
-use codex_core::config_types::McpServerTransportConfig;
+use codex_core::config::types::McpServerConfig;
+use codex_core::config::types::McpServerTransportConfig;
 use codex_core::features::Feature;
 
 use codex_core::protocol::AskForApproval;
diff --git a/codex-rs/core/tests/suite/truncation.rs b/codex-rs/core/tests/suite/truncation.rs
index 74d90f1d..2f23c541 100644
--- a/codex-rs/core/tests/suite/truncation.rs
+++ b/codex-rs/core/tests/suite/truncation.rs
@@ -219,8 +219,8 @@ async fn mcp_tool_call_output_exceeds_limit_truncated_for_model() -> Result<()>
         config.features.enable(Feature::RmcpClient);
         config.mcp_servers.insert(
             server_name.to_string(),
-            codex_core::config_types::McpServerConfig {
-                transport: codex_core::config_types::McpServerTransportConfig::Stdio {
+            codex_core::config::types::McpServerConfig {
+                transport: codex_core::config::types::McpServerTransportConfig::Stdio {
                     command: rmcp_test_server_bin,
                     args: Vec::new(),
                     env: None,
diff --git a/codex-rs/linux-sandbox/tests/suite/landlock.rs b/codex-rs/linux-sandbox/tests/suite/landlock.rs
index a1a37583..508dba08 100644
--- a/codex-rs/linux-sandbox/tests/suite/landlock.rs
+++ b/codex-rs/linux-sandbox/tests/suite/landlock.rs
@@ -1,5 +1,5 @@
 #![cfg(target_os = "linux")]
-use codex_core::config_types::ShellEnvironmentPolicy;
+use codex_core::config::types::ShellEnvironmentPolicy;
 use codex_core::error::CodexErr;
 use codex_core::error::SandboxErr;
 use codex_core::exec::ExecParams;
diff --git a/codex-rs/tui/src/app.rs b/codex-rs/tui/src/app.rs
index 9af54af7..3c06113c 100644
--- a/codex-rs/tui/src/app.rs
+++ b/codex-rs/tui/src/app.rs
@@ -17,7 +17,7 @@ use codex_ansi_escape::ansi_escape_line;
 use codex_core::AuthManager;
 use codex_core::ConversationManager;
 use codex_core::config::Config;
-use codex_core::config_edit::ConfigEditsBuilder;
+use codex_core::config::edit::ConfigEditsBuilder;
 use codex_core::model_family::find_family_for_model;
 use codex_core::protocol::SessionSource;
 use codex_core::protocol::TokenUsage;
diff --git a/codex-rs/tui/src/chatwidget.rs b/codex-rs/tui/src/chatwidget.rs
index 617aba0f..838dacff 100644
--- a/codex-rs/tui/src/chatwidget.rs
+++ b/codex-rs/tui/src/chatwidget.rs
@@ -4,7 +4,7 @@ use std::path::PathBuf;
 use std::sync::Arc;
 
 use codex_core::config::Config;
-use codex_core::config_types::Notifications;
+use codex_core::config::types::Notifications;
 use codex_core::git_info::current_branch_name;
 use codex_core::git_info::local_git_branches;
 use codex_core::project_doc::DEFAULT_PROJECT_DOC_FILENAME;
diff --git a/codex-rs/tui/src/history_cell.rs b/codex-rs/tui/src/history_cell.rs
index 471fec66..c8a3e868 100644
--- a/codex-rs/tui/src/history_cell.rs
+++ b/codex-rs/tui/src/history_cell.rs
@@ -23,8 +23,8 @@ use crate::wrapping::word_wrap_lines;
 use base64::Engine;
 use codex_common::format_env_display::format_env_display;
 use codex_core::config::Config;
-use codex_core::config_types::McpServerTransportConfig;
-use codex_core::config_types::ReasoningSummaryFormat;
+use codex_core::config::types::McpServerTransportConfig;
+use codex_core::config::types::ReasoningSummaryFormat;
 use codex_core::protocol::FileChange;
 use codex_core::protocol::McpAuthStatus;
 use codex_core::protocol::McpInvocation;
@@ -1450,8 +1450,8 @@ mod tests {
     use codex_core::config::Config;
     use codex_core::config::ConfigOverrides;
     use codex_core::config::ConfigToml;
-    use codex_core::config_types::McpServerConfig;
-    use codex_core::config_types::McpServerTransportConfig;
+    use codex_core::config::types::McpServerConfig;
+    use codex_core::config::types::McpServerTransportConfig;
     use codex_core::protocol::McpAuthStatus;
     use codex_protocol::parse_command::ParsedCommand;
     use dirs::home_dir;
diff --git a/codex-rs/tui/src/onboarding/windows.rs b/codex-rs/tui/src/onboarding/windows.rs
index 431f2a1a..715611b7 100644
--- a/codex-rs/tui/src/onboarding/windows.rs
+++ b/codex-rs/tui/src/onboarding/windows.rs
@@ -1,6 +1,6 @@
 use std::path::PathBuf;
 
-use codex_core::config_edit::ConfigEditsBuilder;
+use codex_core::config::edit::ConfigEditsBuilder;
 use crossterm::event::KeyCode;
 use crossterm::event::KeyEvent;
 use crossterm::event::KeyEventKind;