diff --git a/codex/maintain.sh b/codex/maintain.sh
index ff4e916..1ee1fad 100755
--- a/codex/maintain.sh
+++ b/codex/maintain.sh
@@ -10,6 +10,7 @@ cd_repo_root
 log "Refreshing Codex environment and running repository checks"
 
 "$SCRIPT_DIR/setup.sh"
+export PATH="$(pwd)/.codex/bin:$PATH"
 
 if [[ -x scripts/check.sh ]]; then
   ./scripts/check.sh
diff --git a/codex/setup.sh b/codex/setup.sh
index d6170a2..d1d94a6 100755
--- a/codex/setup.sh
+++ b/codex/setup.sh
@@ -14,6 +14,28 @@ for cmd in bash git; do
   have "$cmd" || die "$cmd is required"
 done
 
+install_terraform() {
+  if have terraform; then
+    log "terraform detected: $(command -v terraform)"
+    return 0
+  fi
+
+  have curl || die "curl is required to install terraform"
+  have unzip || die "unzip is required to install terraform"
+
+  local tf_version tf_zip tf_url tf_install_dir tf_tmp_dir
+  tf_version="${TERRAFORM_VERSION:-1.11.4}"
+  tf_zip="terraform_${tf_version}_linux_amd64.zip"
+  tf_url="https://releases.hashicorp.com/terraform/${tf_version}/${tf_zip}"
+  tf_install_dir="$(pwd)/.codex/bin"
+  tf_tmp_dir="$(pwd)/.codex/tmp"
+
+  log "terraform not found; installing v${tf_version} into ${tf_install_dir}"
+  curl -fsSL "$tf_url" -o "${tf_tmp_dir}/${tf_zip}"
+  unzip -qo "${tf_tmp_dir}/${tf_zip}" -d "$tf_install_dir"
+  chmod +x "${tf_install_dir}/terraform"
+}
+
 validate_goproxy() {
   local value="$1"
   local part trimmed
@@ -46,13 +68,17 @@ ensure_dir .codex/bin
 ensure_dir .codex/cache
 ensure_dir .codex/tmp
 ensure_dir .codex/logs
+export PATH="$(pwd)/.codex/bin:$PATH"
 
 cat > .codex/env <<'ENVEOF'
 export CI=1
 export TERM=xterm-256color
 export GIT_PAGER=cat
+export PATH="$(pwd)/.codex/bin:$PATH"
 ENVEOF
 
+install_terraform
+
 if have python3; then
   log "python3 detected"
   if [[ ! -d .codex/venv ]]; then
diff --git a/examples/live_safe_dns_record/main.tf b/examples/live_safe_dns_record/main.tf
index 50fb634..33df823 100644
--- a/examples/live_safe_dns_record/main.tf
+++ b/examples/live_safe_dns_record/main.tf
@@ -6,9 +6,9 @@ provider "dynu" {
 }
 
 locals {
-  hostname_a_ipv4    = "codex-a-${var.test_suffix}.${var.dynu_root_domain}"
-  hostname_aaaa_ipv6 = "codex-aaaa-${var.test_suffix}.${var.dynu_root_domain}"
-  hostname_cname     = "codex-cname-${var.test_suffix}.${var.dynu_root_domain}"
+  hostname_a_ipv4       = "codex-a-${var.test_suffix}.${var.dynu_root_domain}"
+  hostname_aaaa_ipv6    = "codex-aaaa-${var.test_suffix}.${var.dynu_root_domain}"
+  hostname_cname        = "codex-cname-${var.test_suffix}.${var.dynu_root_domain}"
   hostname_dynamic_a    = "codex-dynamic-a-${var.test_suffix}.${var.dynu_root_domain}"
   hostname_dynamic_aaaa = "codex-dynamic-aaaa-${var.test_suffix}.${var.dynu_root_domain}"
 }
diff --git a/examples/live_safe_dns_record/outputs.tf b/examples/live_safe_dns_record/outputs.tf
index 758343e..acc84b2 100644
--- a/examples/live_safe_dns_record/outputs.tf
+++ b/examples/live_safe_dns_record/outputs.tf
@@ -1,9 +1,9 @@
 output "record_hostnames" {
   description = "Disposable hostnames created for each live-safe DNS scenario."
   value = {
-    a_ipv4     = dynu_dns_record.a_ipv4.hostname
-    aaaa_ipv6  = dynu_dns_record.aaaa_ipv6.hostname
-    cname      = dynu_dns_record.cname.hostname
+    a_ipv4       = dynu_dns_record.a_ipv4.hostname
+    aaaa_ipv6    = dynu_dns_record.aaaa_ipv6.hostname
+    cname        = dynu_dns_record.cname.hostname
     dynamic_a    = dynu_dns_record.dynamic_a.hostname
     dynamic_aaaa = dynu_dns_record.dynamic_aaaa.hostname
   }
@@ -12,9 +12,9 @@ output "record_hostnames" {
 output "record_ids" {
   description = "Dynu record IDs (domain_id/record_id) for each scenario."
   value = {
-    a_ipv4     = dynu_dns_record.a_ipv4.id
-    aaaa_ipv6  = dynu_dns_record.aaaa_ipv6.id
-    cname      = dynu_dns_record.cname.id
+    a_ipv4       = dynu_dns_record.a_ipv4.id
+    aaaa_ipv6    = dynu_dns_record.aaaa_ipv6.id
+    cname        = dynu_dns_record.cname.id
     dynamic_a    = dynu_dns_record.dynamic_a.id
     dynamic_aaaa = dynu_dns_record.dynamic_aaaa.id
   }
diff --git a/scripts/check.sh b/scripts/check.sh
index a437d03..a80d81f 100755
--- a/scripts/check.sh
+++ b/scripts/check.sh
@@ -1,6 +1,14 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+if [[ -x codex/setup.sh ]]; then
+  ./codex/setup.sh >/dev/null
+fi
+
+if [[ -d .codex/bin ]]; then
+  export PATH="$(pwd)/.codex/bin:$PATH"
+fi
+
 echo "[check] verifying gofmt"
 files="$(git ls-files '*.go')"
 if [[ -n "${files}" ]]; then
diff --git a/scripts/fix.sh b/scripts/fix.sh
index 8c41967..9e12dfb 100755
--- a/scripts/fix.sh
+++ b/scripts/fix.sh
@@ -1,6 +1,14 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+if [[ -x codex/setup.sh ]]; then
+  ./codex/setup.sh >/dev/null
+fi
+
+if [[ -d .codex/bin ]]; then
+  export PATH="$(pwd)/.codex/bin:$PATH"
+fi
+
 echo "[fix] formatting Go files"
 files="$(git ls-files '*.go')"
 if [[ -n "${files}" ]]; then