diff --git a/claude_desktop/CHANGELOG.md b/claude_desktop/CHANGELOG.md
index 5c8407e9c8..8a43360953 100644
--- a/claude_desktop/CHANGELOG.md
+++ b/claude_desktop/CHANGELOG.md
@@ -1,4 +1,8 @@
  
+## 1.36.1 (27-07-2026)
+
+- Fix the Codex CLI install failing on every boot with `Verified Codex <version> installation failed; Codex is unavailable this boot`, leaving `install_codex_cli` permanently non-functional. The download, its SHA-256 verification, and the extraction all succeeded; the chain broke at the final step, which validates the candidate binary by running `--version` as the `abc` runtime user. `mktemp -d` creates its directory `0700 root:root`, and `abc` cannot traverse a root-only directory, so executing the staged binary failed with `unable to exec: Permission denied` (exit 126) before it could be moved into place. Reproduced and fixed by making the staging directory traversable (`chmod 0755`) immediately after `mktemp`; verified on a live add-on container, where the same probe goes from exit 126 to success once the mode is widened. Nothing secret is staged there — the public release archive and the extracted binary, both world-readable upstream artifacts — and the existing `cleanup()` trap still removes the directory on exit. The validation deliberately keeps running as `abc` rather than root, so the binary is exercised as the identity that will actually run it.
+
 ## 1.36 (27-07-2026)
 
 - Add optional OpenAI Codex CLI support, so a Claude session in this add-on can delegate work to ChatGPT Codex. Three parts: an `install_codex_cli` switch, a browserless way to activate a ChatGPT subscription on it, and an MCP registration that makes Codex callable as a tool from Claude.
diff --git a/claude_desktop/config.yaml b/claude_desktop/config.yaml
index 8f1247d70d..e08dbac7de 100644
--- a/claude_desktop/config.yaml
+++ b/claude_desktop/config.yaml
@@ -122,5 +122,5 @@ slug: claude_desktop
 tmpfs: true
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "1.36"
+version: "1.36.1"
 video: true
diff --git a/claude_desktop/rootfs/etc/cont-init.d/81-codex_cli.sh b/claude_desktop/rootfs/etc/cont-init.d/81-codex_cli.sh
index f6b5ea5f43..a3c72d9f09 100755
--- a/claude_desktop/rootfs/etc/cont-init.d/81-codex_cli.sh
+++ b/claude_desktop/rootfs/etc/cont-init.d/81-codex_cli.sh
@@ -60,6 +60,13 @@ fi
 # follows upstream updates without pinning a version, while downloading the large asset only when
 # the installed version changes. A metadata outage never replaces or removes a working binary.
 codex_tmp="$(mktemp -d -p "$CODEX_ROOT")"
+# mktemp always creates 0700 root:root here, but the candidate binary is validated by running it
+# as the abc runtime user, which cannot traverse a root-only directory — that made every install
+# fail at the --version step with "unable to exec: Permission denied" (exit 126) and report
+# "Codex is unavailable this boot". Make the staging directory traversable. Nothing secret is
+# staged here: it holds the public release archive and the extracted binary, both of which are
+# world-readable upstream artifacts, and cleanup() removes the directory on exit.
+chmod 0755 "$codex_tmp"
 cleanup() {
     rm -rf "$codex_tmp"
 }