diff --git a/codex-rs/.config/nextest.toml b/codex-rs/.config/nextest.toml
index 17decdc0b8..f370a0aa36 100644
--- a/codex-rs/.config/nextest.toml
+++ b/codex-rs/.config/nextest.toml
@@ -90,13 +90,7 @@ test-group = 'core_apply_patch_cli_integration'
 # starting their timeout; their file lock still coordinates other test processes.
 platform = 'cfg(windows)'
 filter = '''
-    (package(codex-core) & (
-        test(windows_sandbox_cli_preserves_managed_deny_reads_across_launches) |
-        test(windows_elevated_does_not_create_missing_workspace_metadata) |
-        test(windows_elevated_enforces_deny_read_and_protects_setup_marker) |
-        test(windows_elevated_unified_exec_enforces_large_recursive_deny_reads) |
-        test(windows_elevated_approved_git_pull_preserves_deny_read)
-    )) |
+    (package(codex-core) & binary(windows_sandbox)) |
     (package(codex-exec-server) & test(file_system_elevated_relative_read_denial_uses_policy_cwd)) |
     (package(codex-windows-sandbox) & test(elevated_non_tty_cmd_forwards_env_output_and_exit))
 '''
diff --git a/codex-rs/core/tests/suite/mod.rs b/codex-rs/core/tests/suite/mod.rs
index 8880c318e2..159e505be7 100644
--- a/codex-rs/core/tests/suite/mod.rs
+++ b/codex-rs/core/tests/suite/mod.rs
@@ -251,8 +251,6 @@ mod web_search;
 mod web_search_system_proxy;
 mod websocket_fallback;
 mod window_headers;
-#[cfg(target_os = "windows")]
-mod windows_sandbox;
 mod workspace_roots;
 mod worktree_trust;
 
diff --git a/codex-rs/core/tests/suite/windows_sandbox.rs b/codex-rs/core/tests/windows_sandbox.rs
similarity index 99%
rename from codex-rs/core/tests/suite/windows_sandbox.rs
rename to codex-rs/core/tests/windows_sandbox.rs
index 006913e4d4..cf7f6a8799 100644
--- a/codex-rs/core/tests/suite/windows_sandbox.rs
+++ b/codex-rs/core/tests/windows_sandbox.rs
@@ -1,3 +1,12 @@
+//! Exercises the Windows sandbox in a dedicated integration-test binary.
+//!
+//! Elevated cases share machine-wide accounts, so keep them out of the sharded
+//! core suite: otherwise several shards spend their test deadlines waiting for
+//! the account lock. The guard still coordinates with other test binaries.
+
+#![cfg(target_os = "windows")]
+#![allow(clippy::expect_used)]
+
 use anyhow::Context;
 use codex_config::types::ApprovalsReviewer;
 use codex_core::TurnInputRequest;