diff --git a/codex-rs/app-server-protocol/src/protocol/v2/tests.rs b/codex-rs/app-server-protocol/src/protocol/v2/tests.rs
index e873998644..3070f881bf 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/tests.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/tests.rs
@@ -3430,6 +3430,23 @@ fn turn_start_params_preserve_explicit_null_service_tier() {
     assert_eq!(serialized_without_override.get("serviceTier"), None);
 }
 
+#[test]
+fn permission_profile_selection_params_uses_id_only_shape() {
+    let params: PermissionProfileSelectionParams = serde_json::from_value(json!({
+        "id": ":workspace"
+    }))
+    .expect("permission profile selection should deserialize");
+    assert_eq!(
+        params,
+        PermissionProfileSelectionParams {
+            id: ":workspace".to_string()
+        }
+    );
+
+    let serialized = serde_json::to_value(&params).expect("params should serialize");
+    assert_eq!(serialized, json!({ "id": ":workspace" }));
+}
+
 #[test]
 fn turn_start_params_round_trip_environments() {
     let cwd = test_absolute_path();
diff --git a/codex-rs/exec/src/lib_tests.rs b/codex-rs/exec/src/lib_tests.rs
index 9c7d36473e..d867a1b75e 100644
--- a/codex-rs/exec/src/lib_tests.rs
+++ b/codex-rs/exec/src/lib_tests.rs
@@ -412,6 +412,7 @@ async fn thread_start_params_include_review_policy_when_review_policy_is_manual_
         .codex_home(codex_home.path().to_path_buf())
         .harness_overrides(ConfigOverrides {
             approvals_reviewer: Some(ApprovalsReviewer::User),
+            default_permissions: Some(":workspace".to_string()),
             ..Default::default()
         })
         .fallback_cwd(Some(cwd.path().to_path_buf()))