diff --git a/template/WORKFLOW.md b/template/WORKFLOW.md
index 86a3ac9..3e60fc5 100644
--- a/template/WORKFLOW.md
+++ b/template/WORKFLOW.md
@@ -29,6 +29,8 @@ codex:
     type: workspaceWrite
     writableRoots: []
     networkAccess: true
+    excludeTmpdirEnvVar: false
+    excludeSlashTmp: false
 ---
 
 Read and follow the canonical delivery-orchestrator prompt in