diff --git a/nix-shared/home-manager/codex-generated-skills.nix b/nix-shared/home-manager/codex-generated-skills.nix
index f7e98b1f..1d8ba87b 100644
--- a/nix-shared/home-manager/codex-generated-skills.nix
+++ b/nix-shared/home-manager/codex-generated-skills.nix
@@ -55,10 +55,11 @@ in {
 
   config = lib.mkIf cfg.enable {
     home.file = {
-      ".codex/.gitignore" = {
-        force = true;
-        source = oos "${cfg.worktreeCodexDir}/.gitignore";
-      };
+      # NB: ~/.codex/.gitignore is intentionally NOT managed here. ~/.codex is
+      # a git-sync-rs checkout of the codex-history repo, which ships its own
+      # real .gitignore — git refuses to read a symlinked ignore file, so an
+      # HM-managed symlink here would silently disable ignore rules and risk
+      # committing auth.json/sqlite state. Leave it to the repo.
 
       ".codex/AGENTS.md" = {
         force = true;