diff --git a/config/codex/default.nix b/config/codex/default.nix
index da6b08e1e..e45e794d5 100644
--- a/config/codex/default.nix
+++ b/config/codex/default.nix
@@ -3,6 +3,7 @@
   # Use activation script instead of home.file symlink
   # Codex CLI uses atomic writes that break symlinks, so we force-copy on each switch
   home.activation.codexConfig = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    $DRY_RUN_CMD mkdir -p ~/.codex
     $DRY_RUN_CMD cp -f ${./config.toml} ~/.codex/config.toml
     $DRY_RUN_CMD chmod 600 ~/.codex/config.toml
   '';
diff --git a/config/openclaw/default.nix b/config/openclaw/default.nix
index fea48f17b..7e5129dce 100644
--- a/config/openclaw/default.nix
+++ b/config/openclaw/default.nix
@@ -11,17 +11,25 @@ let
 
   mode = if host.isKyber then "gateway" else "client";
 
-  hydrateScript = pkgs.replaceVars ./hydrate.sh ({
-    sed = "${pkgs.gnused}/bin/sed";
-    template = ./openclaw.template.json;
-    inherit mode;
-  } // (if host.isKyber then {
-    chromium = pkgs.chromium;
-    openclaw = "${homeDir}/.bun";
-  } else {
-    chromium = "/unused";
-    openclaw = "/unused";
-  }));
+  hydrateScript = pkgs.replaceVars ./hydrate.sh (
+    {
+      sed = "${pkgs.gnused}/bin/sed";
+      template = ./openclaw.template.json;
+      inherit mode;
+    }
+    // (
+      if host.isKyber then
+        {
+          chromium = pkgs.chromium;
+          openclaw = "${homeDir}/.bun";
+        }
+      else
+        {
+          chromium = "/unused";
+          openclaw = "/unused";
+        }
+    )
+  );
 in
 {
   # Hydrate OpenClaw config from .env secrets