diff --git a/.github/workflows/credentials-check.yml b/.github/workflows/credentials-check.yml
index 72161be4aa1..cf7cc63b2a9 100644
--- a/.github/workflows/credentials-check.yml
+++ b/.github/workflows/credentials-check.yml
@@ -33,8 +33,29 @@ jobs:
       - name: Install Codex
         run: npm install -g @openai/codex@0.148.0
       - name: Generate haiku
-        run: codex exec --skip-git-repo-check --sandbox read-only --ephemeral --ignore-user-config --ignore-rules "Write a haiku about credentials in fewer than 100 tokens. Do not use tools."
+        run: |
+          # Codex's built-in "openai" model provider cannot have `supports_websockets`
+          # overridden via `-c` (built-in provider IDs are reserved), and the Responses
+          # WebSocket transport has a known upstream bug where the handshake can be
+          # rejected with a 401 even for valid credentials
+          # (see https://github.com/openai/codex/issues/39578 and
+          # https://github.com/openai/codex/issues/38638). Work around it the same way
+          # the gh-aw Codex engine does for its own proxy provider: define a custom
+          # provider that talks to the same OpenAI endpoint with WebSockets disabled so
+          # only the HTTPS transport is used.
+          mkdir -p /tmp/codex-home
+          cat > /tmp/codex-home/config.toml << 'EOF'
+          model_provider = "openai-direct"
+
+          [model_providers.openai-direct]
+          name = "OpenAI"
+          base_url = "https://api.openai.com/v1"
+          env_key = "OPENAI_API_KEY"
+          supports_websockets = false
+          EOF
+          codex exec --skip-git-repo-check --sandbox read-only --ephemeral --ignore-rules "Write a haiku about credentials in fewer than 100 tokens. Do not use tools."
         env:
+          CODEX_HOME: /tmp/codex-home
           OPENAI_API_KEY: ${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}
   copilot-github-token:
     name: Copilot GitHub Actions token check