diff --git a/AGENTS.md b/AGENTS.md
index dcd43df..6ffecf7 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -157,6 +157,7 @@ Use the narrowest command matching the changed area.
 - `profile_desktop_common` manages shared Void desktop bootstrap, `emptty`, PAM hooks, dotfiles, mail bootstrap, and shared desktop tooling
 - Void desktop user services now use `turnstile` with runit-backed definitions under `dotfiles/desktop/.config/service/`; session launchers refresh the shared turnstile env for GUI-aware services such as `emacs`
 - `ssh-agent` on Void desktops now runs under a separate always-on per-user runsvdir rooted at `~/.local/runit/current`, with a stable socket under `~/.local/state/ssh-agent/socket`
+- `ollama` on Void desktops is installed from the upstream Linux tarball into `/usr/local` and runs as a separate always-on per-user runit service under `~/.local/runit/current`; `Codex CLI` is installed globally via npm and can target that local Ollama instance
 - `profile_desktop_i3` contains the X11/i3 session pieces
 - `profile_desktop_sway` contains the wlroots/Sway session pieces and deploys shared Sway + Waybar dotfiles
 - `profile_desktop_hyprland` contains the optional Hyprland/Wayland session pieces
diff --git a/README.md b/README.md
index 48c6a6d..5eba776 100644
--- a/README.md
+++ b/README.md
@@ -87,6 +87,7 @@ Lo stato attuale del profilo desktop include, tra le altre cose:
 - pacchetti Void Linux e servizi runit
 - `turnstile` per servizi utente agganciati alla sessione, incluso `emacs` come server per `emacsclient`
 - `ssh-agent` come servizio runit utente always-on con socket stabile condiviso tra shell, SSH ed Emacs
+- `ollama` installato da tarball upstream e gestito come servizio runit utente always-on, con `Codex CLI` installato globalmente via npm
 - Flatpak con remoto Flathub
 - GNOME Keyring e bootstrap della posta via script dedicato
 - `Waybar` separata per compositor (`config-sway.jsonc` e `config-hyprland.jsonc`) con `style.css` condiviso
diff --git a/ansible/inventory/group_vars/desktop.yml b/ansible/inventory/group_vars/desktop.yml
index a7f38a8..13c0163 100644
--- a/ansible/inventory/group_vars/desktop.yml
+++ b/ansible/inventory/group_vars/desktop.yml
@@ -124,6 +124,7 @@ profile_packages:
   - xournalpp
   - yaru
   - yaru-plus
+  - zstd
 
 desktop_common_dotfiles:
   - name: XDG autostart entries
@@ -170,6 +171,10 @@ desktop_common_dotfiles:
     src: .config/opencode/
     dest: .config/opencode/
     mode: preserve
+  - name: Codex config
+    src: .codex/
+    dest: .codex/
+    mode: preserve
   - name: Turnstile user services
     src: .config/service/
     dest: .config/service/
diff --git a/ansible/roles/profile_desktop_common/tasks/main.yml b/ansible/roles/profile_desktop_common/tasks/main.yml
index 3035cfe..2dc3033 100644
--- a/ansible/roles/profile_desktop_common/tasks/main.yml
+++ b/ansible/roles/profile_desktop_common/tasks/main.yml
@@ -510,6 +510,12 @@
   tags: [packages]
   ansible.builtin.set_fact:
     desktop_tools_tmp_dir: /tmp/desktop-tools
+    ollama_asset: >-
+      {{
+        'ollama-linux-amd64.tar.zst' if ansible_facts['architecture'] == 'x86_64'
+        else 'ollama-linux-arm64.tar.zst' if ansible_facts['architecture'] in ['aarch64', 'arm64']
+        else ''
+      }}
     gitmux_version: v0.11.5
     bw_version: 1.22.1
     opencode_asset_name: >-
@@ -531,6 +537,12 @@
     msg: "Unsupported architecture {{ ansible_facts['architecture'] }} for OpenCode release binary"
   when: opencode_asset_name == ''
 
+- name: Ensure architecture is supported for Ollama binary
+  tags: [packages]
+  ansible.builtin.fail:
+    msg: "Unsupported architecture {{ ansible_facts['architecture'] }} for Ollama release binary"
+  when: ollama_asset == ''
+
 - name: Ensure architecture is supported for gitmux binary
   tags: [packages]
   ansible.builtin.fail:
@@ -586,6 +598,20 @@
     checksum: "{{ opencode_asset.digest | default(omit) }}"
     mode: "0644"
 
+- name: Download Ollama release archive
+  tags: [packages]
+  ansible.builtin.get_url:
+    url: "https://ollama.com/download/{{ ollama_asset }}"
+    dest: "{{ desktop_tools_tmp_dir }}/{{ ollama_asset }}"
+    mode: "0644"
+  register: ollama_archive_download
+
+- name: Check whether Ollama is already installed
+  tags: [packages]
+  ansible.builtin.stat:
+    path: /usr/local/bin/ollama
+  register: ollama_binary
+
 - name: Extract OpenCode release archive
   tags: [packages]
   ansible.builtin.unarchive:
@@ -603,6 +629,32 @@
     group: root
     mode: "0755"
 
+- name: Remove previous Ollama libraries
+  tags: [packages]
+  ansible.builtin.file:
+    path: /usr/local/lib/ollama
+    state: absent
+  when:
+    - ollama_archive_download.changed or not ollama_binary.stat.exists
+
+- name: Extract Ollama release archive into /usr/local
+  tags: [packages]
+  ansible.builtin.shell: >-
+    zstd -d -c "{{ desktop_tools_tmp_dir }}/{{ ollama_asset }}" |
+    tar -xf - -C /usr/local
+  args:
+    executable: /bin/sh
+  changed_when: true
+  when:
+    - ollama_archive_download.changed or not ollama_binary.stat.exists
+
+- name: Install Codex CLI globally
+  tags: [packages]
+  community.general.npm:
+    name: "@openai/codex"
+    global: true
+    state: present
+
 - name: Set gitmux asset metadata
   tags: [packages]
   ansible.builtin.set_fact:
diff --git a/ansible/roles/services_runit/tasks/main.yml b/ansible/roles/services_runit/tasks/main.yml
index 33dd585..c0837f5 100644
--- a/ansible/roles/services_runit/tasks/main.yml
+++ b/ansible/roles/services_runit/tasks/main.yml
@@ -30,6 +30,8 @@
       mode: "0755"
     - path: "{{ user_home }}/.local/runit/sv"
       mode: "0755"
+    - path: "{{ user_home }}/.local/runit/sv/ollama"
+      mode: "0755"
     - path: "{{ user_home }}/.local/runit/sv/ssh-agent"
       mode: "0755"
     - path: "{{ user_home }}/.local/state"
@@ -46,6 +48,24 @@
     group: "{{ user_group }}"
     mode: "0755"
 
+- name: Render per-user ollama runit service
+  tags: [services, packages]
+  ansible.builtin.template:
+    src: ollama.run.j2
+    dest: "{{ user_home }}/.local/runit/sv/ollama/run"
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+    mode: "0755"
+
+- name: Enable per-user ollama runit service
+  tags: [services, packages]
+  ansible.builtin.file:
+    src: "../sv/ollama"
+    dest: "{{ user_home }}/.local/runit/current/ollama"
+    state: link
+    owner: "{{ username }}"
+    group: "{{ user_group }}"
+
 - name: Enable per-user ssh-agent runit service
   tags: [services, packages]
   ansible.builtin.file:
diff --git a/ansible/roles/services_runit/templates/ollama.run.j2 b/ansible/roles/services_runit/templates/ollama.run.j2
new file mode 100644
index 0000000..aaabcff
--- /dev/null
+++ b/ansible/roles/services_runit/templates/ollama.run.j2
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -eu
+
+exec /usr/local/bin/ollama serve
diff --git a/dotfiles/desktop/.codex/config.toml b/dotfiles/desktop/.codex/config.toml
new file mode 100644
index 0000000..09bee82
--- /dev/null
+++ b/dotfiles/desktop/.codex/config.toml
@@ -0,0 +1,8 @@
+[model_providers.ollama-launch]
+name = "Ollama"
+base_url = "http://localhost:11434/v1"
+
+[profiles.ollama-cloud]
+model = "gpt-5.4"
+model_provider = "ollama-launch"
+model_reasoning_effort = "medium"