diff --git a/.bazelrc b/.bazelrc
index 6357eb83e4..31d626dbce 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -95,6 +95,7 @@ build:clippy --@rules_rust//rust/settings:clippy.toml=//codex-rs:clippy.toml
 build:clippy --@rules_rust//rust/settings:clippy_flag=-Dwarnings
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::await_holding_invalid_type
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::await_holding_lock
+build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::disallowed_methods
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::expect_used
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::identity_op
 build:clippy --@rules_rust//rust/settings:clippy_flag=--deny=clippy::manual_clamp
diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml
index ec38a87cff..7e99ff26c2 100644
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -433,6 +433,7 @@ rust = {}
 [workspace.lints.clippy]
 await_holding_invalid_type = "deny"
 await_holding_lock = "deny"
+disallowed_methods = "deny"
 expect_used = "deny"
 identity_op = "deny"
 manual_clamp = "deny"
diff --git a/codex-rs/app-server-daemon/src/backend/pid.rs b/codex-rs/app-server-daemon/src/backend/pid.rs
index f5f4fc5b66..e4cb172993 100644
--- a/codex-rs/app-server-daemon/src/backend/pid.rs
+++ b/codex-rs/app-server-daemon/src/backend/pid.rs
@@ -177,6 +177,7 @@ impl PidBackend {
             }
         }
 
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let child = match command.spawn() {
             Ok(child) => child,
             Err(err) => {
diff --git a/codex-rs/app-server-daemon/src/update_loop.rs b/codex-rs/app-server-daemon/src/update_loop.rs
index 0fe21e0a6d..22e54aa342 100644
--- a/codex-rs/app-server-daemon/src/update_loop.rs
+++ b/codex-rs/app-server-daemon/src/update_loop.rs
@@ -164,6 +164,7 @@ async fn install_latest_standalone() -> Result<()> {
         .await
         .context("failed to read standalone Codex updater")?;
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = Command::new("/bin/sh")
         .arg("-s")
         .stdin(Stdio::piped())
diff --git a/codex-rs/app-server-test-client/src/lib.rs b/codex-rs/app-server-test-client/src/lib.rs
index fd9ecc845d..4bfd6facc7 100644
--- a/codex-rs/app-server-test-client/src/lib.rs
+++ b/codex-rs/app-server-test-client/src/lib.rs
@@ -482,6 +482,7 @@ impl BackgroundAppServer {
         for override_kv in config_overrides {
             cmd.arg("--config").arg(override_kv);
         }
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let process = cmd
             .arg("app-server")
             .arg("--listen")
@@ -535,6 +536,7 @@ fn serve(codex_bin: &Path, config_overrides: &[String], listen: &str, kill: bool
     }
     cmdline.push_str(&format!(" app-server --listen {}", shell_quote(listen)));
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let child = Command::new("nohup")
         .arg("sh")
         .arg("-c")
@@ -1444,6 +1446,7 @@ impl CodexClient {
         for override_kv in config_overrides {
             cmd.arg("--config").arg(override_kv);
         }
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let mut codex_app_server = cmd
             .arg("app-server")
             .stdin(Stdio::piped())
diff --git a/codex-rs/app-server/tests/common/mcp_process.rs b/codex-rs/app-server/tests/common/mcp_process.rs
index f9c24c226e..d68de69f07 100644
--- a/codex-rs/app-server/tests/common/mcp_process.rs
+++ b/codex-rs/app-server/tests/common/mcp_process.rs
@@ -206,6 +206,7 @@ impl McpProcess {
             }
         }
 
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let mut process = cmd
             .kill_on_drop(true)
             .spawn()
diff --git a/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs b/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs
index cf76b9d573..1790407952 100644
--- a/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs
+++ b/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs
@@ -396,6 +396,7 @@ pub(super) async fn spawn_websocket_server_with_args(
         .stderr(Stdio::piped())
         .env("CODEX_HOME", codex_home)
         .env("RUST_LOG", "warn");
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut process = cmd
         .kill_on_drop(true)
         .spawn()
diff --git a/codex-rs/cli/src/debug_sandbox.rs b/codex-rs/cli/src/debug_sandbox.rs
index bc9d6172f2..627b000f11 100644
--- a/codex-rs/cli/src/debug_sandbox.rs
+++ b/codex-rs/cli/src/debug_sandbox.rs
@@ -491,6 +491,7 @@ async fn spawn_debug_sandbox_child(
         cmd.env(CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR, "1");
     }
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     cmd.stdin(Stdio::inherit())
         .stdout(Stdio::inherit())
         .stderr(Stdio::inherit())
diff --git a/codex-rs/cli/src/debug_sandbox/pid_tracker.rs b/codex-rs/cli/src/debug_sandbox/pid_tracker.rs
index 07bd2fd046..52ea912f2c 100644
--- a/codex-rs/cli/src/debug_sandbox/pid_tracker.rs
+++ b/codex-rs/cli/src/debug_sandbox/pid_tracker.rs
@@ -290,6 +290,7 @@ mod tests {
     #[cfg(target_os = "macos")]
     #[test]
     fn list_child_pids_includes_spawned_child() {
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let mut child = Command::new("/bin/sleep")
             .arg("5")
             .stdin(Stdio::null())
@@ -319,6 +320,7 @@ mod tests {
     async fn pid_tracker_collects_spawned_children() {
         let tracker = PidTracker::new(std::process::id() as i32).expect("failed to create tracker");
 
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let mut child = Command::new("/bin/sleep")
             .arg("0.1")
             .stdin(Stdio::null())
@@ -347,6 +349,7 @@ mod tests {
     async fn pid_tracker_collects_bash_subshell_descendants() {
         let tracker = PidTracker::new(std::process::id() as i32).expect("failed to create tracker");
 
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let child = Command::new("/bin/bash")
             .arg("-c")
             .arg("(sleep 0.1 & echo $!; wait)")
diff --git a/codex-rs/cli/src/debug_sandbox/seatbelt.rs b/codex-rs/cli/src/debug_sandbox/seatbelt.rs
index a1d6435b51..c1c4461bb2 100644
--- a/codex-rs/cli/src/debug_sandbox/seatbelt.rs
+++ b/codex-rs/cli/src/debug_sandbox/seatbelt.rs
@@ -89,6 +89,7 @@ fn start_log_stream() -> Option<Child> {
 
     const PREDICATE: &str = r#"(((processID == 0) AND (senderImagePath CONTAINS "/Sandbox")) OR (subsystem == "com.apple.sandbox.reporting"))"#;
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     tokio::process::Command::new("log")
         .args(["stream", "--style", "ndjson", "--predicate", PREDICATE])
         .stdin(Stdio::null())
diff --git a/codex-rs/clippy.toml b/codex-rs/clippy.toml
index 2feed8a487..bd81abc1c3 100644
--- a/codex-rs/clippy.toml
+++ b/codex-rs/clippy.toml
@@ -6,6 +6,9 @@ await-holding-invalid-types = [
     "tokio::sync::RwLockWriteGuard",
 ]
 disallowed-methods = [
+    { path = "std::process::Command::spawn", reason = "Don't leak processes on Drop." },
+    { path = "tokio::process::Command::spawn", reason = "Don't leak processes on Drop." },
+    { path = "portable_pty::SlavePty::spawn_command", reason = "Don't leak processes on Drop." },
     { path = "ratatui::style::Color::Rgb", reason = "Use ANSI colors, which work better in various terminal themes." },
     { path = "ratatui::style::Color::Indexed", reason = "Use ANSI colors, which work better in various terminal themes." },
     { path = "ratatui::style::Stylize::white", reason = "Avoid hardcoding white; prefer default fg or dim/bold. Exception: Disable this rule if rendering over a hardcoded ANSI background." },
diff --git a/codex-rs/core-plugins/src/marketplace_upgrade/git.rs b/codex-rs/core-plugins/src/marketplace_upgrade/git.rs
index 9a46465dbc..6c38c03f79 100644
--- a/codex-rs/core-plugins/src/marketplace_upgrade/git.rs
+++ b/codex-rs/core-plugins/src/marketplace_upgrade/git.rs
@@ -168,6 +168,7 @@ fn run_git_command_with_timeout(
     context: &str,
     timeout: Duration,
 ) -> Result<Output, String> {
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = command
         .stdin(Stdio::null())
         .stdout(Stdio::piped())
diff --git a/codex-rs/core-plugins/src/startup_sync.rs b/codex-rs/core-plugins/src/startup_sync.rs
index f03aff93f6..817eb6b062 100644
--- a/codex-rs/core-plugins/src/startup_sync.rs
+++ b/codex-rs/core-plugins/src/startup_sync.rs
@@ -523,6 +523,7 @@ fn run_git_command_with_timeout(
     context: &str,
     timeout: Duration,
 ) -> Result<Output, String> {
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = command
         .stdin(Stdio::null())
         .stdout(Stdio::piped())
diff --git a/codex-rs/core/src/spawn.rs b/codex-rs/core/src/spawn.rs
index a2c4ebe597..f1a759d419 100644
--- a/codex-rs/core/src/spawn.rs
+++ b/codex-rs/core/src/spawn.rs
@@ -122,5 +122,6 @@ pub(crate) async fn spawn_child_async(request: SpawnChildRequest<'_>) -> std::io
         }
     }
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     cmd.kill_on_drop(true).spawn()
 }
diff --git a/codex-rs/core/tests/suite/live_cli.rs b/codex-rs/core/tests/suite/live_cli.rs
index 5e2c0415ea..b632406eec 100644
--- a/codex-rs/core/tests/suite/live_cli.rs
+++ b/codex-rs/core/tests/suite/live_cli.rs
@@ -60,6 +60,7 @@ fn run_live(prompt: &str) -> (assert_cmd::assert::Assert, TempDir) {
     cmd.stdout(Stdio::piped());
     cmd.stderr(Stdio::piped());
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = cmd.spawn().expect("failed to spawn codex-rs");
 
     // Send the terminating newline so Session::run exits after the first turn.
diff --git a/codex-rs/core/tests/suite/rmcp_client.rs b/codex-rs/core/tests/suite/rmcp_client.rs
index 94222deab8..ee185d7912 100644
--- a/codex-rs/core/tests/suite/rmcp_client.rs
+++ b/codex-rs/core/tests/suite/rmcp_client.rs
@@ -2099,6 +2099,7 @@ async fn start_streamable_http_test_server(
     if let Some(expected_token) = expected_token {
         command.env("MCP_EXPECT_BEARER", expected_token);
     }
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = command.spawn()?;
 
     wait_for_local_streamable_http_server(&mut child, &server_url, Duration::from_secs(5)).await?;
diff --git a/codex-rs/debug-client/src/client.rs b/codex-rs/debug-client/src/client.rs
index 69eb474aaf..8d3d8222c4 100644
--- a/codex-rs/debug-client/src/client.rs
+++ b/codex-rs/debug-client/src/client.rs
@@ -63,6 +63,7 @@ impl AppServerClient {
             cmd.arg("--config").arg(override_kv);
         }
 
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let mut child = cmd
             .arg("app-server")
             .stdin(Stdio::piped())
diff --git a/codex-rs/exec-server/src/client_transport.rs b/codex-rs/exec-server/src/client_transport.rs
index 4bdc09a80e..bdc44429a8 100644
--- a/codex-rs/exec-server/src/client_transport.rs
+++ b/codex-rs/exec-server/src/client_transport.rs
@@ -82,6 +82,7 @@ impl ExecServerClient {
     pub(crate) async fn connect_stdio_command(
         args: StdioExecServerConnectArgs,
     ) -> Result<Self, ExecServerError> {
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let mut child = stdio_command_process(&args.command)
             .stdin(Stdio::piped())
             .stdout(Stdio::piped())
diff --git a/codex-rs/exec-server/src/fs_sandbox.rs b/codex-rs/exec-server/src/fs_sandbox.rs
index 76b0f22b2b..7e97d669a8 100644
--- a/codex-rs/exec-server/src/fs_sandbox.rs
+++ b/codex-rs/exec-server/src/fs_sandbox.rs
@@ -298,6 +298,7 @@ fn spawn_command(
     command.stdin(std::process::Stdio::piped());
     command.stdout(std::process::Stdio::piped());
     command.stderr(std::process::Stdio::piped());
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     command.spawn().map_err(io_error)
 }
 
diff --git a/codex-rs/exec-server/tests/common/exec_server.rs b/codex-rs/exec-server/tests/common/exec_server.rs
index f1bf03d25b..bef32aebad 100644
--- a/codex-rs/exec-server/tests/common/exec_server.rs
+++ b/codex-rs/exec-server/tests/common/exec_server.rs
@@ -76,6 +76,7 @@ where
     child.kill_on_drop(true);
     child.env("CODEX_HOME", codex_home.path());
     child.envs(env);
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = child.spawn()?;
 
     let websocket_url = read_listen_url_from_stdout(&mut child).await?;
diff --git a/codex-rs/exec-server/tests/common/mod.rs b/codex-rs/exec-server/tests/common/mod.rs
index 387edf36db..3e217d1c7c 100644
--- a/codex-rs/exec-server/tests/common/mod.rs
+++ b/codex-rs/exec-server/tests/common/mod.rs
@@ -89,6 +89,7 @@ fn run_delayed_output_after_exit_parent(release_path: &Path) {
             std::process::exit(1);
         }
     };
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     match Command::new(current_exe)
         .arg(DELAYED_OUTPUT_AFTER_EXIT_CHILD_ARG)
         .arg(release_path)
diff --git a/codex-rs/exec/tests/suite/sandbox.rs b/codex-rs/exec/tests/suite/sandbox.rs
index 0a5381b1ef..163666b281 100644
--- a/codex-rs/exec/tests/suite/sandbox.rs
+++ b/codex-rs/exec/tests/suite/sandbox.rs
@@ -76,6 +76,7 @@ async fn spawn_command_under_sandbox(
         }
     }
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     child.kill_on_drop(true).spawn()
 }
 
diff --git a/codex-rs/hooks/src/engine/command_runner.rs b/codex-rs/hooks/src/engine/command_runner.rs
index 7366d4ec51..9add3913e4 100644
--- a/codex-rs/hooks/src/engine/command_runner.rs
+++ b/codex-rs/hooks/src/engine/command_runner.rs
@@ -38,6 +38,7 @@ pub(crate) async fn run_command(
         .stderr(Stdio::piped())
         .kill_on_drop(true);
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = match command.spawn() {
         Ok(child) => child,
         Err(err) => {
diff --git a/codex-rs/hooks/src/legacy_notify.rs b/codex-rs/hooks/src/legacy_notify.rs
index 0e273b421f..2ef0b92264 100644
--- a/codex-rs/hooks/src/legacy_notify.rs
+++ b/codex-rs/hooks/src/legacy_notify.rs
@@ -60,6 +60,7 @@ pub fn notify_hook(argv: Vec<String>) -> Hook {
                     .stdout(Stdio::null())
                     .stderr(Stdio::null());
 
+                #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
                 match command.spawn() {
                     Ok(_) => HookResult::Success,
                     Err(err) => HookResult::FailedContinue(err.into()),
diff --git a/codex-rs/mcp-server/tests/common/mcp_process.rs b/codex-rs/mcp-server/tests/common/mcp_process.rs
index f50f25f49f..b60d2f4fec 100644
--- a/codex-rs/mcp-server/tests/common/mcp_process.rs
+++ b/codex-rs/mcp-server/tests/common/mcp_process.rs
@@ -78,6 +78,7 @@ impl McpProcess {
             }
         }
 
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let mut process = cmd
             .kill_on_drop(true)
             .spawn()
diff --git a/codex-rs/rmcp-client/tests/streamable_http_test_support.rs b/codex-rs/rmcp-client/tests/streamable_http_test_support.rs
index cfff33ab43..c973ba9081 100644
--- a/codex-rs/rmcp-client/tests/streamable_http_test_support.rs
+++ b/codex-rs/rmcp-client/tests/streamable_http_test_support.rs
@@ -199,6 +199,7 @@ pub(crate) async fn spawn_streamable_http_server() -> anyhow::Result<(Child, Str
 
     let bind_addr = format!("127.0.0.1:{port}");
     let base_url = format!("http://{bind_addr}");
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = Command::new(streamable_http_server_bin()?)
         .kill_on_drop(true)
         .env("MCP_STREAMABLE_HTTP_BIND_ADDR", &bind_addr)
@@ -225,6 +226,7 @@ impl Drop for ExecServerProcess {
 /// Starts a local exec-server and connects an initialized `ExecServerClient`.
 pub(crate) async fn spawn_exec_server() -> anyhow::Result<ExecServerProcess> {
     let codex_home = TempDir::new()?;
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = Command::new(codex_utils_cargo_bin::cargo_bin("codex")?)
         .args(["exec-server", "--listen", "ws://127.0.0.1:0"])
         .stdin(Stdio::null())
diff --git a/codex-rs/sandboxing/src/bwrap.rs b/codex-rs/sandboxing/src/bwrap.rs
index 633487136a..33015897a3 100644
--- a/codex-rs/sandboxing/src/bwrap.rs
+++ b/codex-rs/sandboxing/src/bwrap.rs
@@ -72,6 +72,7 @@ fn system_bwrap_warning_for_path(system_bwrap_path: Option<&Path>) -> Option<Str
 }
 
 fn system_bwrap_has_user_namespace_access(system_bwrap_path: &Path, timeout: Duration) -> bool {
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = match Command::new(system_bwrap_path)
         .args([
             "--unshare-user",
diff --git a/codex-rs/shell-command/src/command_safety/powershell_parser.rs b/codex-rs/shell-command/src/command_safety/powershell_parser.rs
index ddcbdf5727..644a28462a 100644
--- a/codex-rs/shell-command/src/command_safety/powershell_parser.rs
+++ b/codex-rs/shell-command/src/command_safety/powershell_parser.rs
@@ -113,6 +113,7 @@ struct PowershellParserProcess {
 
 impl PowershellParserProcess {
     fn spawn(executable: &str) -> std::io::Result<Self> {
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let mut child = Command::new(executable)
             .args([
                 "-NoLogo",
diff --git a/codex-rs/shell-escalation/src/unix/escalate_server.rs b/codex-rs/shell-escalation/src/unix/escalate_server.rs
index 55abf7d734..fd5a349dba 100644
--- a/codex-rs/shell-escalation/src/unix/escalate_server.rs
+++ b/codex-rs/shell-escalation/src/unix/escalate_server.rs
@@ -345,6 +345,7 @@ async fn handle_escalate_session_with_policy(
                     Ok(())
                 });
             }
+            #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
             let mut child = command.spawn()?;
             let exit_status = tokio::select! {
                 status = child.wait() => status?,
diff --git a/codex-rs/stdio-to-uds/tests/stdio_to_uds.rs b/codex-rs/stdio-to-uds/tests/stdio_to_uds.rs
index 0bc4b0c7f3..8b804d8dc6 100644
--- a/codex-rs/stdio-to-uds/tests/stdio_to_uds.rs
+++ b/codex-rs/stdio-to-uds/tests/stdio_to_uds.rs
@@ -72,6 +72,7 @@ async fn pipes_stdin_and_stdout_through_socket() -> anyhow::Result<()> {
     let child_task = tokio::task::spawn_blocking(move || -> anyhow::Result<ChildOutput> {
         let stdin =
             std::fs::File::open(&request_path).context("failed to open child stdin fixture")?;
+        #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
         let mut child = Command::new(codex_utils_cargo_bin::cargo_bin("codex-stdio-to-uds")?)
             .arg(&socket_path)
             .stdin(Stdio::from(stdin))
diff --git a/codex-rs/tui/src/clipboard_copy.rs b/codex-rs/tui/src/clipboard_copy.rs
index 1ad369d24b..0d397544bb 100644
--- a/codex-rs/tui/src/clipboard_copy.rs
+++ b/codex-rs/tui/src/clipboard_copy.rs
@@ -262,6 +262,10 @@ fn arboard_copy(_text: &str) -> Result<Option<ClipboardLease>, String> {
 /// Copy text into the Windows clipboard from a WSL process.
 #[cfg(target_os = "linux")]
 fn wsl_clipboard_copy(text: &str) -> Result<(), String> {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "Grandfathered-in usage."
+    )]
     let mut child = std::process::Command::new("powershell.exe")
         .stdin(std::process::Stdio::piped())
         .stdout(std::process::Stdio::null())
@@ -321,6 +325,7 @@ fn tmux_clipboard_copy(text: &str) -> Result<(), String> {
         || tmux_command_output(["info"]),
     )?;
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = std::process::Command::new("tmux")
         .args(["load-buffer", "-w", "-"])
         .stdin(std::process::Stdio::piped())
diff --git a/codex-rs/utils/pty/src/pipe.rs b/codex-rs/utils/pty/src/pipe.rs
index 541a2ecf2f..9559251419 100644
--- a/codex-rs/utils/pty/src/pipe.rs
+++ b/codex-rs/utils/pty/src/pipe.rs
@@ -147,6 +147,7 @@ async fn spawn_process_with_stdin_mode(
     command.stdout(Stdio::piped());
     command.stderr(Stdio::piped());
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = command.spawn()?;
     let pid = child
         .id()
diff --git a/codex-rs/utils/pty/src/pty.rs b/codex-rs/utils/pty/src/pty.rs
index 45c587b328..b10576fb87 100644
--- a/codex-rs/utils/pty/src/pty.rs
+++ b/codex-rs/utils/pty/src/pty.rs
@@ -158,6 +158,7 @@ async fn spawn_process_portable(
         command_builder.env(key, value);
     }
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = pair.slave.spawn_command(command_builder)?;
     #[cfg(unix)]
     // portable-pty establishes the spawned PTY child as a new session leader on
@@ -322,6 +323,7 @@ async fn spawn_process_preserving_fds(
             });
     }
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     let mut child = command.spawn()?;
     drop(slave);
     let process_group_id = child.id();
diff --git a/codex-rs/utils/sleep-inhibitor/src/linux_inhibitor.rs b/codex-rs/utils/sleep-inhibitor/src/linux_inhibitor.rs
index e97d42b223..9a970aa6c1 100644
--- a/codex-rs/utils/sleep-inhibitor/src/linux_inhibitor.rs
+++ b/codex-rs/utils/sleep-inhibitor/src/linux_inhibitor.rs
@@ -222,6 +222,7 @@ fn spawn_backend(backend: LinuxBackend) -> Result<Child, std::io::Error> {
         });
     }
 
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     command.spawn()
 }
 
diff --git a/codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs b/codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs
index f0475bc39f..68a196820b 100644
--- a/codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs
+++ b/codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs
@@ -163,6 +163,7 @@ fn spawn_read_acl_helper(payload: &Payload, _log: &mut File) -> Result<()> {
     let payload_json = serde_json::to_vec(&read_payload)?;
     let payload_b64 = BASE64.encode(payload_json);
     let exe = std::env::current_exe().context("locate setup helper")?;
+    #[allow(clippy::disallowed_methods, reason = "Grandfathered-in usage.")]
     Command::new(&exe)
         .arg(payload_b64)
         .stdin(Stdio::null())