diff --git a/services/cassandra/generator-deployment.yaml b/services/cassandra/generator-deployment.yaml
index ff27046d2..2e87bac10 100644
--- a/services/cassandra/generator-deployment.yaml
+++ b/services/cassandra/generator-deployment.yaml
@@ -71,6 +71,23 @@ spec:
           envFrom:
             - configMapRef:
                 name: cassandra-config
+          env:
+            - name: CASSANDRA_STRATEGY_SPEC_USE_CODEX
+              value: "1"
+            - name: CASSANDRA_STRATEGY_AUTHORING_CODEX_BIN
+              value: codex
+            - name: CASSANDRA_STRATEGY_AUTHORING_CODEX_MODEL
+              value: gpt-5.3-codex-spark
+            - name: CASSANDRA_STRATEGY_AUTHORING_CODEX_REASONING
+              value: low
+            - name: CASSANDRA_STRATEGY_SPEC_TIMEOUT
+              value: "900"
+            - name: CASSANDRA_CODEX_CLI_AUTH_MOUNT_PATH
+              value: /var/run/cassandra-codex-cli
+            - name: CASSANDRA_CODEX_CLI_LOGIN_FILE
+              value: login.json
+            - name: CODEX_HOME
+              value: /home/cassandra/.codex
           resources:
             requests:
               cpu: 100m
@@ -85,3 +102,18 @@ spec:
             allowPrivilegeEscalation: false
             capabilities:
               drop: ["ALL"]
+          volumeMounts:
+            - name: codex-cli
+              mountPath: /var/run/cassandra-codex-cli
+              readOnly: true
+            - name: codex-home
+              mountPath: /home/cassandra/.codex
+      volumes:
+        - name: codex-cli
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: cassandra-generator-codex-cli
+        - name: codex-home
+          emptyDir: {}
diff --git a/services/cassandra/secretproviderclass.yaml b/services/cassandra/secretproviderclass.yaml
index a1a0f483b..853f3dea0 100644
--- a/services/cassandra/secretproviderclass.yaml
+++ b/services/cassandra/secretproviderclass.yaml
@@ -73,3 +73,19 @@ spec:
         secretPath: "kv/data/atlas/cassandra/codex-cli"
         secretKey: "auth.json"
         filePermission: 292
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: cassandra-generator-codex-cli
+  namespace: cassandra
+spec:
+  provider: vault
+  parameters:
+    vaultAddress: "http://vault.vault.svc.cluster.local:8200"
+    roleName: "cassandra"
+    objects: |
+      - objectName: "auth.json"
+        secretPath: "kv/data/atlas/cassandra/codex-cli"
+        secretKey: "auth.json"
+        filePermission: 292