diff --git a/codex-rs/windows-sandbox-rs/build.rs b/codex-rs/windows-sandbox-rs/build.rs
index 3aca5b7e3e..35e96d1cbe 100644
--- a/codex-rs/windows-sandbox-rs/build.rs
+++ b/codex-rs/windows-sandbox-rs/build.rs
@@ -1,4 +1,6 @@
 fn main() {
+    println!("cargo:rerun-if-changed=codex-windows-sandbox-setup.manifest");
+
     if std::env::var_os("RULES_RUST_BAZEL_BUILD_SCRIPT_RUNNER").is_some()
         && matches!(std::env::var("CARGO_CFG_TARGET_ENV").as_deref(), Ok("gnu"))
     {
@@ -11,5 +13,8 @@ fn main() {
 
     let mut res = winres::WindowsResource::new();
     res.set_manifest_file("codex-windows-sandbox-setup.manifest");
-    let _ = res.compile();
+    // Shipping without this manifest can make Windows treat the helper like
+    // an installer and reject non-elevated refresh launches with error 740.
+    res.compile()
+        .expect("failed to embed codex-windows-sandbox-setup.exe manifest");
 }