diff --git a/codex-rs/core/src/config.rs b/codex-rs/core/src/config.rs
index c094de54..b5574cea 100644
--- a/codex-rs/core/src/config.rs
+++ b/codex-rs/core/src/config.rs
@@ -1,3 +1,5 @@
+use std::path::PathBuf;
+
 use dirs::home_dir;
 use serde::Deserialize;
 
@@ -28,15 +30,36 @@ impl Config {
     }
 
     fn load_from_toml() -> Option<Self> {
-        let mut p = home_dir()?;
-        p.push(".codex/config.toml");
+        let mut p = codex_dir().ok()?;
+        p.push("config.toml");
         let contents = std::fs::read_to_string(&p).ok()?;
         toml::from_str(&contents).ok()
     }
 
     fn load_instructions() -> Option<String> {
-        let mut p = home_dir()?;
-        p.push(".codex/instructions.md");
+        let mut p = codex_dir().ok()?;
+        p.push("instructions.md");
         std::fs::read_to_string(&p).ok()
     }
 }
+
+/// Returns the path to the Codex configuration directory, which is `~/.codex`.
+/// Does not verify that the directory exists.
+pub fn codex_dir() -> std::io::Result<PathBuf> {
+    let mut p = home_dir().ok_or_else(|| {
+        std::io::Error::new(
+            std::io::ErrorKind::NotFound,
+            "Could not find home directory",
+        )
+    })?;
+    p.push(".codex");
+    Ok(p)
+}
+
+/// Returns the path to the folder where Codex logs are stored. Does not verify
+/// that the directory exists.
+pub fn log_dir() -> std::io::Result<PathBuf> {
+    let mut p = codex_dir()?;
+    p.push("log");
+    Ok(p)
+}
diff --git a/codex-rs/tui/src/lib.rs b/codex-rs/tui/src/lib.rs
index 4a063de0..d0f5f664 100644
--- a/codex-rs/tui/src/lib.rs
+++ b/codex-rs/tui/src/lib.rs
@@ -31,19 +31,31 @@ pub use cli::Cli;
 pub fn run_main(cli: Cli) -> std::io::Result<()> {
     assert_env_var_set();
 
+    let log_dir = codex_core::config::log_dir()?;
+    std::fs::create_dir_all(&log_dir)?;
     // Open (or create) your log file, appending to it.
-    let file = OpenOptions::new()
-        .create(true)
-        .append(true)
-        .open("/tmp/codex-rs.log")?;
+    let mut log_file_opts = OpenOptions::new();
+    log_file_opts.create(true).append(true);
+
+    // Ensure the file is only readable and writable by the current user.
+    // Doing the equivalent to `chmod 600` on Windows is quite a bit more code
+    // and requires the Windows API crates, so we can reconsider that when
+    // Codex CLI is officially supported on Windows.
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        log_file_opts.mode(0o600);
+    }
+
+    let log_file = log_file_opts.open(log_dir.join("codex-tui.log"))?;
 
     // Wrap file in non‑blocking writer.
-    let (non_blocking, _guard) = non_blocking(file);
+    let (non_blocking, _guard) = non_blocking(log_file);
 
-    // use RUST_LOG env var, default to trace for codex crates.
+    // use RUST_LOG env var, default to info for codex crates.
     let env_filter = || {
         EnvFilter::try_from_default_env()
-            .unwrap_or_else(|_| EnvFilter::new("codex=trace,codex_tui=trace"))
+            .unwrap_or_else(|_| EnvFilter::new("codex_core=info,codex_tui=info"))
     };
 
     // Build layered subscriber: