diff --git a/codex-rs/core/src/session/session.rs b/codex-rs/core/src/session/session.rs
index 59e60ccd19..ddcbb34d4b 100644
--- a/codex-rs/core/src/session/session.rs
+++ b/codex-rs/core/src/session/session.rs
@@ -309,7 +309,7 @@ impl SessionConfiguration {
                     })?;
                 config
                     .permissions
-                    .set_permission_profile_with_active_profile(
+                    .set_permission_profile_from_session_snapshot(
                         permission_profile,
                         Some(active_permission_profile),
                     )?;
diff --git a/codex-rs/core/src/session/tests.rs b/codex-rs/core/src/session/tests.rs
index 420dc2a4cd..91c68714df 100644
--- a/codex-rs/core/src/session/tests.rs
+++ b/codex-rs/core/src/session/tests.rs
@@ -3809,6 +3809,7 @@ async fn active_profile_update_rebuilds_network_proxy_config() -> std::io::Resul
             (
                 "locked-down".to_string(),
                 PermissionProfileToml {
+                    workspace_roots: None,
                     filesystem: Some(FilesystemPermissionsToml {
                         glob_scan_max_depth: None,
                         entries: std::collections::BTreeMap::from([(
@@ -3822,6 +3823,7 @@ async fn active_profile_update_rebuilds_network_proxy_config() -> std::io::Resul
             (
                 "web-enabled".to_string(),
                 PermissionProfileToml {
+                    workspace_roots: None,
                     filesystem: Some(FilesystemPermissionsToml {
                         glob_scan_max_depth: None,
                         entries: std::collections::BTreeMap::from([(
@@ -3884,7 +3886,7 @@ async fn active_profile_update_rebuilds_network_proxy_config() -> std::io::Resul
 
     let updated = session_configuration
         .apply(&SessionSettingsUpdate {
-            permission_profile: Some(selected_config.permissions.permission_profile()),
+            permission_profile: Some(selected_config.permissions.permission_profile().clone()),
             active_permission_profile: selected_config.permissions.active_permission_profile(),
             ..Default::default()
         })