diff --git a/action.yml b/action.yml
index 6d76521..ff583c8 100644
--- a/action.yml
+++ b/action.yml
@@ -303,7 +303,7 @@ runs:
         fi
 
     - name: Drop sudo privilege, if appropriate
-      if: ${{ inputs['safety-strategy'] == 'drop-sudo' && ((runner.os == 'macOS' && (inputs['openai-api-key'] != '' || inputs.prompt != '' || inputs['prompt-file'] != '')) || (runner.os == 'Linux' && inputs['openai-api-key'] != '' && inputs.prompt == '' && inputs['prompt-file'] == '')) }}
+      if: ${{ inputs['safety-strategy'] == 'drop-sudo' && inputs['openai-api-key'] != '' && (runner.os != 'Linux' || (inputs.prompt == '' && inputs['prompt-file'] == '')) }}
       shell: bash
       env:
         ACTION_PATH: ${{ github.action_path }}
@@ -323,7 +323,7 @@ runs:
         esac
 
     - name: Verify sudo privilege removed
-      if: ${{ inputs['safety-strategy'] == 'drop-sudo' && ((runner.os == 'macOS' && (inputs['openai-api-key'] != '' || inputs.prompt != '' || inputs['prompt-file'] != '')) || (runner.os == 'Linux' && inputs['openai-api-key'] != '' && inputs.prompt == '' && inputs['prompt-file'] == '')) }}
+      if: ${{ inputs['safety-strategy'] == 'drop-sudo' && inputs['openai-api-key'] != '' && (runner.os != 'Linux' || (inputs.prompt == '' && inputs['prompt-file'] == '')) }}
       shell: bash
       run: |
         if sudo -n true 2>/dev/null; then
diff --git a/docs/security.md b/docs/security.md
index bb73ca9..94894a7 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -58,7 +58,7 @@ If you have effectively opened up your use of `openai/codex-action` to the world
 
 ## Protecting your `OPENAI_API_KEY`
 
-No doubt your `OPENAI_API_KEY` is an important secret that you do not want to share with the world. **Be sure to use either `drop-sudo` or `unprivileged-user` to ensure it stays secret!** On Linux, the reduced process identity applies to Codex launched by the action; direct Codex commands in later steps do not pass through it.
+No doubt your `OPENAI_API_KEY` is an important secret that you do not want to share with the world. **Be sure to use either `drop-sudo` or `unprivileged-user` to ensure it stays secret!**
 
 To underscore the importance of specifying either `drop-sudo` or `unprivileged-user` as the `safety-strategy` for `openai/codex-action`, we provide [an example](../examples/test-sandbox-protections.yml) of how **the combination of read-only access to the filesystem and `sudo` can be used to expose your `OPENAI_API_KEY`**. This often surprises developers, as many expect the combination of "read-only access" and no network to be a sufficient safeguard, but this is not the case in the presence of passwordless `sudo` (which is the default on GitHub-hosted runners). Notably, Linux's [procfs](https://en.wikipedia.org/wiki/Procfs) makes a considerable amount of information available via file-read operations to a user with appropriate privileges.