diff --git a/dev-util/codex/Manifest b/dev-util/codex/Manifest
index 36d97cb978..8367591d18 100644
--- a/dev-util/codex/Manifest
+++ b/dev-util/codex/Manifest
@@ -1,7 +1,9 @@
 DIST codex-0.157.1.tar.gz 16115184 BLAKE2B d8fd027fe5808a722bf4e77dd78854930a806746e78ff5e80f464d5f172af971e5fed38f307f9e8fce3b8d5d02d903020aed08e23c404e93885fb6574464481a SHA512 2e95b06fe2172fd03cd0ecfc6594a663cd0085641d38b79ef6b3772e5b1ddc83aa606f265e79c854f79baa57617845867ae202d015e93e357f9bd4eae32cbbfa
 DIST codex-0.158.0.tar.gz 16454306 BLAKE2B cc9b213069155bcea845038dc85d9483a69195241f7c2f90b0f128b8eb10e407ede161435a94f359f5acc30de43d7ea15992e3e868b87770ff17513eeb1ec72c SHA512 2675fa47b52dfcb7a5d37245a93719bb38545c7117deb17b9fc108eacfdb9e81a87e175b47446d548eca3a37cf4f80d9ba3f6bfd36dadc618393e3af5f0fd4c7
+DIST codex-0.159.3.tar.gz 16577987 BLAKE2B 5bcce4c0635edf11e2458f1a2d8dfd8bcb70b057b54f96c8d51baeaad433c3f671ac5096856e58b3b4d9add49525c7e38f681be38909e1d5eded03c8a1cc5ba5 SHA512 2bb16a6e45c82316d36608eb2c02d092f436c00e1c67dc15b4560e2ab8cbdf1d4a0ef3b58d5fb0750bd33a589170e7983e0f9d1eb9d925042d529ff88b2ef691
 DIST codex-rust-v0.157.1-crates.tar.xz 157554932 BLAKE2B 97eed631134b7a03e2923f1a1a8548d1c746e8b24f43fe352fc47b27a2c02de15ad676939976eefb515786fa314cc6f0499dc46fc6e3559c13a4dea0fd7c21ba SHA512 9fb979c584745cf77c99638f83465a953ee100aff8c048700318d09bbd6105d0c25b8eeefd9b9dc5bd414370591d0f6acc89c9d4f5d0a262bb6424532aea4c6d
 DIST codex-rust-v0.158.0-crates.tar.xz 157554932 BLAKE2B 97eed631134b7a03e2923f1a1a8548d1c746e8b24f43fe352fc47b27a2c02de15ad676939976eefb515786fa314cc6f0499dc46fc6e3559c13a4dea0fd7c21ba SHA512 9fb979c584745cf77c99638f83465a953ee100aff8c048700318d09bbd6105d0c25b8eeefd9b9dc5bd414370591d0f6acc89c9d4f5d0a262bb6424532aea4c6d
+DIST codex-rust-v0.159.3-crates.tar.xz 157554932 BLAKE2B 97eed631134b7a03e2923f1a1a8548d1c746e8b24f43fe352fc47b27a2c02de15ad676939976eefb515786fa314cc6f0499dc46fc6e3559c13a4dea0fd7c21ba SHA512 9fb979c584745cf77c99638f83465a953ee100aff8c048700318d09bbd6105d0c25b8eeefd9b9dc5bd414370591d0f6acc89c9d4f5d0a262bb6424532aea4c6d
 DIST crossterm-efa177859fd9623d57b9fe7ae9bf491ae1ac6ec4.gh.tar.gz 145349 BLAKE2B c75ce5f67f7d0040f183a32cd1d8420a307e2acf11de9163a0c69fbd788de34452dcc48b160b2cf15d64c971634f7fe93a50127582aaac14d70373a4b68324f4 SHA512 6aedeb88d51e59db101aa37a0f3b77f24f4a251e3a3da533c32c6919102b93ff02cdcb4b37b3eeb7407debf1c970c51e6f05bf0baa0eb206497a33c6c9e68895
 DIST h3-e07e69412876f7e26f026bd75a48b2704d8c8283.gh.tar.gz 244832 BLAKE2B bea2d550925b09b3fd0a33aef734a26a7457d91dc0a89fe72cd6de684dd2f2a37de5ac615691e7d92cc47fa7aaad4ab13c253dd30eaa3287f7d62e139f77d07a SHA512 9dc2589b2ea013f6bb79c05fb515fdf236834116241ecb33c783b64102e3904c11beea7d75ad12d3fd48b66276387da96c162657010292eae5a8c84260ef94d2
 DIST mxc-6cd3d58f05d3447e67109cfb75e042803b843ca4.gh.tar.gz 5985947 BLAKE2B f2c48e8d16586407986dee718cc2aa9bc58174e6e9e1a13b36bcc5a9aae7d9f033863479d077e2e579a21d07914043fcac52d0981feb9230109336675fe28485 SHA512 ac2ce0b3a30a0e0faff40a31fea16d44a7eea1c40cce3bbb8fa98319d221a04b5ab27085620c1929d4c1d17b3cefea1e3e0586a8246a8569199e417e804ddbba
diff --git a/dev-util/codex/codex-0.159.3.ebuild b/dev-util/codex/codex-0.159.3.ebuild
new file mode 100644
index 0000000000..8de803cb5b
--- /dev/null
+++ b/dev-util/codex/codex-0.159.3.ebuild
@@ -0,0 +1,195 @@
+# Copyright 2025-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# NOTE: This package uses a pre-built crate tarball instead of listing individual
+# crates in CRATES="". This approach is required because:
+# 1. Codex has 800+ crate dependencies, which triggers Portage QA warnings:
+#    "QA Notice: This package uses a very large number of CRATES. Please provide
+#    a crate tarball instead and fetch it via SRC_URI."
+# 2. Stricter ebuild QA checks (e.g., in CI pipelines) fail with too many crates.
+#
+# The crate tarball is auto-generated by GitHub Actions at:
+#   https://github.com/gentoo-zh-drafts/codex/
+# Workflow source code for auditing:
+#   https://github.com/gentoo-zh-drafts/codex/blob/crate-dist/.github/workflows/crates.yml
+# This allows anyone to review and verify the crate packaging process.
+
+CRATES="
+"
+
+declare -A GIT_CRATES=(
+	[appcontainer_common]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/backends/appcontainer/common'
+	[crossterm]='https://github.com/openai-oss-forks/crossterm;efa177859fd9623d57b9fe7ae9bf491ae1ac6ec4;crossterm-%commit%'
+	[h3]='https://github.com/hyperium/h3;e07e69412876f7e26f026bd75a48b2704d8c8283;h3-%commit%/h3'
+	[h3-quinn]='https://github.com/hyperium/h3;e07e69412876f7e26f026bd75a48b2704d8c8283;h3-%commit%/h3-quinn'
+	[learning_mode_windows]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/backends/learning_mode/windows'
+	[nucleo-matcher]='https://github.com/helix-editor/nucleo;4253de9faabb4e5c6d81d946a5e35a90f87347ee;nucleo-%commit%/matcher'
+	[nucleo]='https://github.com/helix-editor/nucleo;4253de9faabb4e5c6d81d946a5e35a90f87347ee;nucleo-%commit%'
+	[runfiles]='https://github.com/dzbarsky/rules_rust;b56cbaa8465e74127f1ea216f813cd377295ad81;rules_rust-%commit%/rust/runfiles'
+	[tokio-tungstenite]='https://github.com/openai-oss-forks/tokio-tungstenite;0e5b2d73aa18dd9f0a50ee9ff199d5aef7594186;tokio-tungstenite-%commit%'
+	[tungstenite]='https://github.com/openai-oss-forks/tungstenite-rs;4fffad30fe373adbdcffab9545e9e9bf4f2fc19f;tungstenite-rs-%commit%'
+	[wxc_common]='https://github.com/microsoft/mxc;6cd3d58f05d3447e67109cfb75e042803b843ca4;mxc-%commit%/src/core/wxc_common'
+)
+
+RUST_MIN_VER="1.95.0"
+
+# python3 .github/scripts/rusty_v8_bazel.py resolved-v8-crate-version
+RUSTY_V8_TAG="150.4.0"
+
+inherit cargo check-reqs toolchain-funcs
+
+CHECKREQS_MEMORY="15G"
+CHECKREQS_DISK_BUILD="20G"
+
+DESCRIPTION="Codex CLI - OpenAI's AI-powered coding agent"
+HOMEPAGE="https://github.com/openai/codex"
+
+# The crate tarball URL uses ${PV} so it auto-updates when bumping versions.
+# This tarball is generated by: https://github.com/gentoo-zh-drafts/codex/
+# See .github/workflows/crates.yml for the generation process.
+SRC_URI="
+	https://github.com/openai/${PN}/archive/rust-v${PV}.tar.gz -> ${PN}-${PV}.tar.gz
+	https://github.com/gentoo-zh-drafts/codex/releases/download/rust-v${PV}/codex-rust-v${PV}-crates.tar.xz
+	amd64? (
+		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/librusty_v8_release_x86_64-unknown-linux-musl.a.gz
+			-> rusty_v8_${RUSTY_V8_TAG}_librusty_v8_release_x86_64-unknown-linux-musl.a.gz
+		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/src_binding_release_x86_64-unknown-linux-musl.rs
+			-> rusty_v8_${RUSTY_V8_TAG}_src_binding_release_x86_64-unknown-linux-musl.rs
+	)
+	arm64? (
+		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/librusty_v8_release_aarch64-unknown-linux-musl.a.gz
+			-> rusty_v8_${RUSTY_V8_TAG}_librusty_v8_release_aarch64-unknown-linux-musl.a.gz
+		https://github.com/openai/codex/releases/download/rusty-v8-v${RUSTY_V8_TAG}/src_binding_release_aarch64-unknown-linux-musl.rs
+			-> rusty_v8_${RUSTY_V8_TAG}_src_binding_release_aarch64-unknown-linux-musl.rs
+	)
+	${CARGO_CRATE_URIS}
+"
+
+S="${WORKDIR}/${PN}-rust-v${PV}/codex-rs"
+
+PATCHES=( "${FILESDIR}"/${PN}-0.156.0-recursion-limit.patch )
+
+LICENSE="Apache-2.0"
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD-2 BSD Boost-1.0
+	CC0-1.0 CDLA-Permissive-2.0 ISC MIT MPL-2.0 Unicode-3.0 ZLIB
+"
+SLOT="0"
+KEYWORDS="-* ~amd64 ~arm64"
+# Tests fail due to ring crate conflicts with system OpenSSL
+RESTRICT="test"
+
+DEPEND="
+	dev-libs/openssl:=
+	sys-apps/dbus
+"
+RDEPEND="${DEPEND}
+	>=sys-apps/bubblewrap-0.11.2
+	sys-apps/ripgrep
+"
+BDEPEND="virtual/pkgconfig"
+
+# rust does not use *FLAGS from make.conf, silence portage warning
+QA_FLAGS_IGNORED="usr/lib/${PN}/bin/*"
+
+pkg_pretend() {
+	check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	check-reqs_pkg_setup
+	rust_pkg_setup
+	if tc-is-lto; then
+		export CARGO_PROFILE_RELEASE_LTO=thin
+	else
+		export CARGO_PROFILE_RELEASE_LTO=false
+	fi
+}
+
+gen_git_crate_dir() {
+	# https://github.com/gentoo/gentoo/blob/b09dd88412fe2d5eee5a8891e08bfa2d67848da3/eclass/cargo.eclass#L442
+	IFS=';' read -r crate_uri commit crate_dir <<<"${GIT_CRATES[$1]}"
+	echo "${WORKDIR}/${crate_dir//%commit%/${commit}}"
+}
+
+src_prepare() {
+	default
+
+	# Fix tokio-tungstenite's git dependency on tungstenite
+	sed -i '/^\[dependencies\.tungstenite\]/,/^$/{
+		s|git = "https://github.com/openai-oss-forks/tungstenite-rs"|path = "'"$(gen_git_crate_dir tungstenite)"'"|
+		/^rev = /d
+	}' "$(gen_git_crate_dir tokio-tungstenite)/Cargo.toml" || die
+
+	# Remove the [patch.crates-io] section and add path-based patches
+	sed -i '/^\[patch\.crates-io\]/,/^$/d' "${S}/Cargo.toml" || die
+	sed -i '/^\[patch\."ssh:\/\/git@github\.com/,/^$/d' "${S}/Cargo.toml" || die
+
+	# Add new patch section with local paths
+	cat >> "${S}/Cargo.toml" <<-EOF || die
+
+	[patch.crates-io]
+	crossterm = { path = "$(gen_git_crate_dir crossterm)" }
+	tokio-tungstenite = { path = "$(gen_git_crate_dir tokio-tungstenite)" }
+	tungstenite = { path = "$(gen_git_crate_dir tungstenite)" }
+	EOF
+}
+
+src_compile() {
+	local rusty_v8_triple
+	use amd64 && rusty_v8_triple=x86_64-unknown-linux-musl
+	use arm64 && rusty_v8_triple=aarch64-unknown-linux-musl
+
+	# codex-core trait resolution overflows rustc's default 8MiB stack
+	export RUST_MIN_STACK=16777216
+
+	RUSTY_V8_ARCHIVE="${DISTDIR}/rusty_v8_${RUSTY_V8_TAG}_librusty_v8_release_${rusty_v8_triple}.a.gz" \
+	RUSTY_V8_SRC_BINDING_PATH="${DISTDIR}/rusty_v8_${RUSTY_V8_TAG}_src_binding_release_${rusty_v8_triple}.rs" \
+		cargo_src_compile \
+			--bin codex \
+			--bin codex-code-mode-host
+}
+
+src_install() {
+	local pkgdir="/usr/lib/${PN}"
+	local pkg_target
+	case ${ARCH} in
+		amd64) pkg_target="x86_64-unknown-linux-gnu" ;;
+		arm64) pkg_target="aarch64-unknown-linux-gnu" ;;
+	esac
+
+	exeinto "${pkgdir}"/bin
+	doexe "$(cargo_target_dir)/codex" "$(cargo_target_dir)/codex-code-mode-host"
+
+	# The app-server daemon installs the CLI from this layout, see
+	# https://github.com/openai/codex/issues/48050
+	cat > "${T}"/codex-package.json <<-EOF || die
+		{
+		  "layoutVersion": 1,
+		  "version": "${PV}",
+		  "target": "${pkg_target}",
+		  "variant": "codex",
+		  "entrypoint": "bin/codex",
+		  "resourcesDir": "codex-resources",
+		  "pathDir": "codex-path"
+		}
+	EOF
+	insinto "${pkgdir}"
+	doins "${T}"/codex-package.json
+
+	# The layout requires both files, they resolve to the system programs
+	printf '#!/bin/sh\nexec %s/usr/bin/rg "$@"\n' "${EPREFIX}" > "${T}"/rg || die
+	printf '#!/bin/sh\nexec %s/usr/bin/bwrap "$@"\n' "${EPREFIX}" > "${T}"/bwrap || die
+	exeinto "${pkgdir}"/codex-path
+	doexe "${T}"/rg
+	exeinto "${pkgdir}"/codex-resources
+	doexe "${T}"/bwrap
+
+	dosym ../lib/"${PN}"/bin/codex /usr/bin/"${PN}"
+	dosym ../lib/"${PN}"/bin/codex-code-mode-host /usr/bin/codex-code-mode-host
+
+	einstalldocs
+}