diff --git a/developer/Dockerfile b/developer/Dockerfile
index e1aa6b1..afbd1cb 100644
--- a/developer/Dockerfile
+++ b/developer/Dockerfile
@@ -25,6 +25,9 @@ ENV LC_ALL=C.UTF-8
 ENV TERM=xterm-256color
 ENV EDITOR=nvim
 ENV SHELL=/bin/zsh
+ENV CODEX_HOME=/root/.codex
+ENV CORE_DEV_HOST_HOME=/host-home
+ENV CODEX_AUTH_SYNC=1
 ENV GOPATH=/root/go
 ENV CARGO_HOME=/root/.cargo
 ENV RUSTUP_HOME=/root/.rustup
@@ -283,7 +286,7 @@ COPY --chmod=644 config/aliases.sh /etc/profile.d/aliases.sh
 COPY --chmod=755 scripts/entrypoint.sh /usr/local/bin/entrypoint.sh
 
 # Create directories
-RUN mkdir -p /root/.config /root/.claude /workspace
+RUN mkdir -p /root/.config /root/.claude /root/.codex /workspace
 
 WORKDIR /workspace
 
diff --git a/developer/scripts/entrypoint.sh b/developer/scripts/entrypoint.sh
index efc1829..4d76b82 100644
--- a/developer/scripts/entrypoint.sh
+++ b/developer/scripts/entrypoint.sh
@@ -3,6 +3,28 @@
 
 set -e
 
+sync_dir() {
+    src="$1"
+    dst="$2"
+
+    if [ ! -d "$src" ]; then
+        return 0
+    fi
+
+    mkdir -p "$dst"
+    # Copy host state into container state each boot so auth/extensions are portable.
+    cp -a "$src"/. "$dst"/
+}
+
+# Sync Codex auth/state from host profile if mounted.
+# Example: -v "$HOME:/host-home:ro"
+if [ "${CODEX_AUTH_SYNC:-1}" = "1" ]; then
+    HOST_HOME="${CORE_DEV_HOST_HOME:-/host-home}"
+    HOST_CODEX_HOME="${HOST_HOME}/.codex"
+    CONTAINER_CODEX_HOME="${CODEX_HOME:-${HOME}/.codex}"
+    sync_dir "$HOST_CODEX_HOME" "$CONTAINER_CODEX_HOME"
+fi
+
 # Run pre-start hooks if they exist
 if [ -d "/root/.config/core-dev/hooks/pre-start" ]; then
     for hook in /root/.config/core-dev/hooks/pre-start/*; do
@@ -26,8 +48,8 @@ fi
 # Setup SSH agent if keys exist
 if [ -d "$HOME/.ssh" ] && [ -z "$SSH_AUTH_SOCK" ]; then
     eval "$(ssh-agent -s)" > /dev/null 2>&1
-    for key in $HOME/.ssh/id_* ; do
-        [ -f "$key" ] && [ ! -f "$key.pub" ] || ssh-add "$key" 2>/dev/null || true
+    for key in "$HOME"/.ssh/id_*; do
+        [ -f "$key" ] && [ ! -f "$key.pub" ] && ssh-add "$key" 2>/dev/null || true
     done
 fi