diff --git a/elixir/README.md b/elixir/README.md
index 6cb3ea98fe..eb4aabdef9 100644
--- a/elixir/README.md
+++ b/elixir/README.md
@@ -119,6 +119,9 @@ Notes:
 - When `codex.turn_sandbox_policy` is set explicitly, Symphony passes the map through to Codex
   unchanged. Compatibility then depends on the targeted Codex app-server version rather than local
   Symphony validation.
+- Workflows that run package managers or other commands that resolve external hosts should set
+  `networkAccess: true` in `codex.turn_sandbox_policy`; otherwise DNS/network access may be denied
+  by the Codex turn sandbox.
 - `agent.max_turns` caps how many back-to-back Codex turns Symphony will run in a single agent
   invocation when a turn completes normally but the issue is still in an active state. Default: `20`.
 - If the Markdown body is blank, Symphony uses a default prompt template that includes the issue
diff --git a/elixir/WORKFLOW.md b/elixir/WORKFLOW.md
index 27e82cacc4..a458db0da3 100644
--- a/elixir/WORKFLOW.md
+++ b/elixir/WORKFLOW.md
@@ -34,6 +34,7 @@ codex:
   thread_sandbox: workspace-write
   turn_sandbox_policy:
     type: workspaceWrite
+    networkAccess: true
 ---
 
 You are working on a Linear ticket `{{ issue.identifier }}`