diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 0d6b2f8e..50ce2c52 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -1264,6 +1264,7 @@ jobs:
             echo "❌ AWOOOP_OPERATOR_API_KEY missing from production secret; source-link canary cannot run"
             exit 1
           fi
+          export AWOOOP_OPERATOR_API_KEY
 
           # 2026-05-05 Codex: use the keepalived VIP instead of a fixed node.
           # Host runner launches the CI image explicitly to avoid act RWLayer=nil.
@@ -1314,6 +1315,7 @@ jobs:
         run: |
           SOURCE_LINK_CANARY_WORK_ITEM_ID="${{ steps.alert_chain_smoke.outputs.source_link_canary_work_item_id }}"
           SOURCE_LINK_CANARY_EVENT_ID="${{ steps.alert_chain_smoke.outputs.source_link_canary_event_id }}"
+          export SOURCE_LINK_CANARY_WORK_ITEM_ID SOURCE_LINK_CANARY_EVENT_ID
           if docker run --rm \
             --name "awoooi-cd-${GITHUB_RUN_ID:-manual}-${GITHUB_RUN_ATTEMPT:-1}-source-link-smoke" \
             --cpus "0.5" \
diff --git a/apps/api/tests/test_cd_post_deploy_source_link_gate.py b/apps/api/tests/test_cd_post_deploy_source_link_gate.py
index e7caf96a..ce7db172 100644
--- a/apps/api/tests/test_cd_post_deploy_source_link_gate.py
+++ b/apps/api/tests/test_cd_post_deploy_source_link_gate.py
@@ -31,6 +31,8 @@ def test_cd_source_link_gate_uses_current_deploy_canary() -> None:
     text = _workflow_text()
 
     assert "SOURCE_LINK_RUN_REF=\"gitea-cd-${GITHUB_RUN_ID:-manual}-${GITHUB_RUN_ATTEMPT:-1}\"" in text
+    assert "export AWOOOP_OPERATOR_API_KEY" in text
+    assert "export SOURCE_LINK_CANARY_WORK_ITEM_ID SOURCE_LINK_CANARY_EVENT_ID" in text
     assert "--source-link-canary-target-incident-id INC-20260505-25E744" in text
     assert "--work-item-id \"${SOURCE_LINK_CANARY_WORK_ITEM_ID}\"" in text
     assert "--expected-source-event-provider-event-id \"${SOURCE_LINK_CANARY_EVENT_ID}\"" in text