diff --git a/codex-rs/cloud-requirements/src/lib.rs b/codex-rs/cloud-requirements/src/lib.rs
index b66c7a03a..6ec596028 100644
--- a/codex-rs/cloud-requirements/src/lib.rs
+++ b/codex-rs/cloud-requirements/src/lib.rs
@@ -51,6 +51,7 @@ const CLOUD_REQUIREMENTS_FETCH_ATTEMPT_METRIC: &str = "codex.cloud_requirements.
 const CLOUD_REQUIREMENTS_FETCH_FINAL_METRIC: &str = "codex.cloud_requirements.fetch_final";
 const CLOUD_REQUIREMENTS_LOAD_METRIC: &str = "codex.cloud_requirements.load";
 const CLOUD_REQUIREMENTS_LOAD_FAILED_MESSAGE: &str = "failed to load your workspace-managed config";
+const CLOUD_REQUIREMENTS_PARSE_FAILED_MESSAGE: &str = "Your workspace-managed config is invalid and could not be parsed. Please contact your workspace admin.";
 const CLOUD_REQUIREMENTS_AUTH_RECOVERY_FAILED_MESSAGE: &str = "Your authentication session could not be refreshed automatically. Please log out and sign in again.";
 const CLOUD_REQUIREMENTS_CACHE_WRITE_HMAC_KEY: &[u8] =
     b"codex-cloud-requirements-cache-v3-064f8542-75b4-494c-a294-97d3ce597271";
@@ -491,7 +492,7 @@ impl CloudRequirementsService {
                         return Err(CloudRequirementsLoadError::new(
                             CloudRequirementsLoadErrorCode::Parse,
                             /*status_code*/ None,
-                            CLOUD_REQUIREMENTS_LOAD_FAILED_MESSAGE,
+                            format_cloud_requirements_parse_failed_message(contents, &err),
                         ));
                     }
                 },
@@ -749,6 +750,13 @@ fn parse_cloud_requirements(
     }
 }
 
+fn format_cloud_requirements_parse_failed_message(
+    _contents: &str,
+    err: &toml::de::Error,
+) -> String {
+    format!("{CLOUD_REQUIREMENTS_PARSE_FAILED_MESSAGE}\n\nDetails:\n{err}")
+}
+
 fn emit_fetch_attempt_metric(
     trigger: &str,
     attempt: usize,
@@ -1617,10 +1625,43 @@ enabled = false
             CLOUD_REQUIREMENTS_TIMEOUT,
         );
 
-        assert!(service.fetch().await.is_err());
+        let err = service
+            .fetch()
+            .await
+            .expect_err("parse error should fail closed");
+        let err_text = err.to_string();
+        assert!(err_text.contains(CLOUD_REQUIREMENTS_PARSE_FAILED_MESSAGE));
+        assert!(err_text.contains("Details:"));
+        assert!(err_text.contains("not = ["));
+        assert_eq!(err.code(), CloudRequirementsLoadErrorCode::Parse);
         assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
     }
 
+    #[tokio::test]
+    async fn fetch_cloud_requirements_invalid_enum_value_surfaces_field_name() {
+        let fetcher = Arc::new(SequenceFetcher::new(vec![Ok(Some(
+            "allowed_approval_policies = [\"definitely-not-valid\"]".to_string(),
+        ))]));
+        let codex_home = tempdir().expect("tempdir");
+        let service = CloudRequirementsService::new(
+            auth_manager_with_plan("business"),
+            fetcher,
+            codex_home.path().to_path_buf(),
+            CLOUD_REQUIREMENTS_TIMEOUT,
+        );
+
+        let err = service
+            .fetch()
+            .await
+            .expect_err("invalid enum value should fail closed");
+        let err_text = err.to_string();
+        assert!(err_text.contains(CLOUD_REQUIREMENTS_PARSE_FAILED_MESSAGE));
+        assert!(err_text.contains("allowed_approval_policies"));
+        assert!(err_text.contains("definitely-not-valid"));
+        assert!(err_text.contains("unknown variant"));
+        assert_eq!(err.code(), CloudRequirementsLoadErrorCode::Parse);
+    }
+
     #[tokio::test]
     async fn fetch_cloud_requirements_uses_cache_when_valid() {
         let codex_home = tempdir().expect("tempdir");