diff --git a/codex-rs/cli/src/lib.rs b/codex-rs/cli/src/lib.rs
index 5e2ba0caa5b9..4e63df187eab 100644
--- a/codex-rs/cli/src/lib.rs
+++ b/codex-rs/cli/src/lib.rs
@@ -26,7 +26,7 @@ pub use login::run_logout;
 #[derive(Debug, Parser)]
 pub struct SeatbeltCommand {
     /// Named permissions profile to apply from the active configuration stack.
-    #[arg(long = "permissions-profile", value_name = "NAME")]
+    #[arg(long = "permissions-profile", short = 'P', value_name = "NAME")]
     pub permissions_profile: Option<String>,
 
     /// Layer $CODEX_HOME/<name>.config.toml on top of the base user config.
@@ -74,7 +74,7 @@ fn parse_allow_unix_socket_path(raw: &str) -> Result<AbsolutePathBuf, String> {
 #[derive(Debug, Parser)]
 pub struct LandlockCommand {
     /// Named permissions profile to apply from the active configuration stack.
-    #[arg(long = "permissions-profile", value_name = "NAME")]
+    #[arg(long = "permissions-profile", short = 'P', value_name = "NAME")]
     pub permissions_profile: Option<String>,
 
     /// Layer $CODEX_HOME/<name>.config.toml on top of the base user config.
@@ -109,7 +109,7 @@ pub struct LandlockCommand {
 #[derive(Debug, Parser)]
 pub struct WindowsCommand {
     /// Named permissions profile to apply from the active configuration stack.
-    #[arg(long = "permissions-profile", value_name = "NAME")]
+    #[arg(long = "permissions-profile", short = 'P', value_name = "NAME")]
     pub permissions_profile: Option<String>,
 
     /// Layer $CODEX_HOME/<name>.config.toml on top of the base user config.
diff --git a/codex-rs/cli/src/main.rs b/codex-rs/cli/src/main.rs
index bb0daf389054..b194a5ab1b3e 100644
--- a/codex-rs/cli/src/main.rs
+++ b/codex-rs/cli/src/main.rs
@@ -2880,6 +2880,21 @@ mod tests {
         assert_eq!(command.command, vec!["echo"]);
     }
 
+    #[cfg(any(target_os = "macos", target_os = "linux", target_os = "windows"))]
+    #[test]
+    fn sandbox_parses_permissions_profile_short_alias() {
+        let cli =
+            MultitoolCli::try_parse_from(["codex", "sandbox", "-P", ":workspace", "--", "echo"])
+                .expect("parse");
+
+        let Some(Subcommand::Sandbox(command)) = cli.subcommand else {
+            panic!("expected sandbox command");
+        };
+
+        assert_eq!(command.permissions_profile.as_deref(), Some(":workspace"));
+        assert_eq!(command.command, vec!["echo"]);
+    }
+
     #[cfg(any(target_os = "macos", target_os = "linux", target_os = "windows"))]
     #[test]
     fn sandbox_parses_config_profile() {