diff --git a/news/changelog-1.9.md b/news/changelog-1.9.md
index 302a91367ff..c025c5227b1 100644
--- a/news/changelog-1.9.md
+++ b/news/changelog-1.9.md
@@ -46,3 +46,4 @@ All changes included in 1.9:
 
 - ([#13402](https://github.com/quarto-dev/quarto-cli/issues/13402)): `nfpm` (<https://nfpm.goreleaser.com/>) is now used to create the `.deb` package, and new `.rpm` package. Both Linux packages are also now built for `x86_64` (`amd64`) and `aarch64` (`arm64`) architectures.
 - ([#13528](https://github.com/quarto-dev/quarto-cli/pull/13528)): Adds support for table specification using nested lists and the `list-table` class.
+- ([#13575](https://github.com/quarto-dev/quarto-cli/pull/13575)): Improve CPU architecture detection/reporting in macOS to allow quarto to run in virtualized environments such as OpenAI's `codex`.
diff --git a/package/scripts/common/quarto b/package/scripts/common/quarto
index 7e5cd584ff2..0585a391f46 100755
--- a/package/scripts/common/quarto
+++ b/package/scripts/common/quarto
@@ -129,15 +129,26 @@ fi
 if [[ $OSTYPE == 'darwin'* ]]; then
   # We cannot use uname to determine the _machine_ architecture:
   # https://github.com/quarto-dev/quarto-cli/issues/2420#issuecomment-1245768732
-  FULLARCH="$(/usr/sbin/sysctl machdep.cpu.brand_string)"
-  
-  if [[ $FULLARCH == *"Intel"* ]]; then
+  # However, sysctl can return unexpected values in sandboxed/virtualized environments.
+  # Use sysctl -n to get just the value, and check multiple possible patterns.
+  FULLARCH="$(/usr/sbin/sysctl -n machdep.cpu.brand_string 2>/dev/null)"
+
+  if [[ $FULLARCH == *"Intel"* ]] || [[ $FULLARCH == *"Xeon"* ]] || [[ $FULLARCH == *"Core"* ]]; then
     ARCH_DIR=x86_64
-  elif [[ $FULLARCH == *"Apple"* ]]; then
+  elif [[ $FULLARCH == *"Apple"* ]] || [[ $FULLARCH == *"ARM"* ]]; then
     ARCH_DIR=aarch64
   else
-    echo "quarto script failed: unrecognized architecture " ${FULLARCH}
-    exit 1
+    # Fallback to uname -m if sysctl doesn't give us recognizable output
+    # This helps with sandboxed/virtualized environments
+    UNAME_ARCH=$(uname -m)
+    if [[ $UNAME_ARCH == "x86_64" ]]; then
+      ARCH_DIR=x86_64
+    elif [[ $UNAME_ARCH == "arm64" ]]; then
+      ARCH_DIR=aarch64
+    else
+      echo "quarto script failed: unrecognized architecture. sysctl returned: '${FULLARCH}', uname -m returned: '${UNAME_ARCH}'"
+      exit 1
+    fi
   fi
 
 else