diff --git a/docs/plans/workflow-system.md b/docs/plans/workflow-system.md
index c1ecda6..680ab12 100644
--- a/docs/plans/workflow-system.md
+++ b/docs/plans/workflow-system.md
@@ -37,6 +37,9 @@ and add no abstraction without a demonstrated repeated need.
 - Decide whether the one-time legacy dashboard BSON migration is still needed.
 - Confirm whether the authoritative dashboard copy's `.env` and `.data` should
   supersede the divergent private state in the sync copy.
+- Rotate the exposed Context7 key and provide `CONTEXT7_API_KEY` through a
+  mode-0600 machine-local environment file on each workstation before removing
+  the static user-config header.
 - Relocate the mode-0644 `/home/kiri/work/SECRETS` file to an approved private
   owner and restrict it; its contents have not been inspected.
 - Destructive cleanup, credentials, activation, and empirical pilot decisions
@@ -57,4 +60,7 @@ and add no abstraction without a demonstrated repeated need.
   flake. Its exports, `.env`, and MongoDB state remain untouched and private.
 - The obsolete `feat/echarts-domain` worktree path is absent; its branch remains
   and its prunable metadata has not been removed.
+- Shared Codex defaults and MCP endpoints are generated at
+  `/etc/codex/config.toml`; Context7 reads its header from the environment. The
+  unused generic `~/.config/mcp/mcp.json` owner is removed on next activation.
 - Run independent pilots in parallel, but gate every retirement separately.
diff --git a/modules/capabilities/ai.nix b/modules/capabilities/ai.nix
index 047a9d0..e8d02b1 100644
--- a/modules/capabilities/ai.nix
+++ b/modules/capabilities/ai.nix
@@ -6,11 +6,48 @@ in
 {
   flake.modules.nixos.ai =
     { pkgs, ... }:
+    let
+      codexConfig = (pkgs.formats.toml { }).generate "codex-config.toml" {
+        model = "gpt-5.6-sol";
+        model_reasoning_effort = "high";
+        plan_mode_reasoning_effort = "high";
+        service_tier = "default";
+        approvals_reviewer = "auto_review";
+
+        tui = {
+          status_line = [
+            "model-with-reasoning"
+            "current-dir"
+            "context-remaining"
+            "five-hour-limit"
+            "weekly-limit"
+            "git-branch"
+          ];
+          status_line_use_colors = true;
+        };
+
+        mcp_servers = {
+          context7 = {
+            url = "https://mcp.context7.com/mcp";
+            env_http_headers.CONTEXT7_API_KEY = "CONTEXT7_API_KEY";
+          };
+          nixos = {
+            command = "${pkgs.uv}/bin/uvx";
+            args = [ "mcp-nixos" ];
+            startup_timeout_sec = 60.0;
+            tools.nix.approval_mode = "approve";
+          };
+          openaiDeveloperDocs.url = "https://developers.openai.com/mcp";
+        };
+      };
+    in
     {
       imports = [ nixosModules.podman ];
 
       home-manager.sharedModules = [ hmModules.ai ];
 
+      environment.etc."codex/config.toml".source = codexConfig;
+
       nixpkgs.overlays = [ inputs.llm-agents.overlays.shared-nixpkgs ];
 
       nix.settings = {
@@ -54,14 +91,6 @@ in
         };
       };
 
-      programs.mcp = {
-        enable = true;
-        servers.nixos = {
-          command = "${pkgs.uv}/bin/uvx";
-          args = [ "mcp-nixos" ];
-        };
-      };
-
       home.packages = [
         pkgs.llm-agents.codex
         pkgs.llm-agents.pi