diff --git a/internal/cloud/code-agent-agentrun-result.ts b/internal/cloud/code-agent-agentrun-result.ts
index 905484b0..e181a679 100644
--- a/internal/cloud/code-agent-agentrun-result.ts
+++ b/internal/cloud/code-agent-agentrun-result.ts
@@ -146,11 +146,22 @@ export function agentRunFreshSessionFailure(result = {}) {
 
 export function providerCredentialSecretRef(profile, env) {
   const profileEnvKey = String(profile ?? "").toUpperCase().replace(/[^A-Z0-9]+/gu, "_");
+  const secretEnvName = `HWLAB_CODE_AGENT_AGENTRUN_${profileEnvKey}_SECRET_NAME`;
+  const secretName = firstNonEmpty(env[secretEnvName]);
+  if (!secretName) {
+    throw Object.assign(new Error(`AgentRun provider Secret name is not configured for profile ${profile}`), {
+      code: "agentrun_provider_secret_not_configured",
+      statusCode: 500,
+      profile,
+      envName: secretEnvName,
+      valuesPrinted: false
+    });
+  }
   return {
     profile,
     secretRef: {
       namespace: firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_SECRET_NAMESPACE, DEFAULT_RUNNER_NAMESPACE),
-      name: firstNonEmpty(env[`HWLAB_CODE_AGENT_AGENTRUN_${profileEnvKey}_SECRET_NAME`], env[`HWLAB_CODE_AGENT_AGENTRUN_${String(profile ?? "").toUpperCase()}_SECRET_NAME`], env.HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_SECRET_NAME, `agentrun-v01-provider-${profile}`),
+      name: secretName,
       keys: ["auth.json", "config.toml"],
       mountPath: firstNonEmpty(env.HWLAB_CODE_AGENT_AGENTRUN_CODEX_HOME_MOUNT, "~/.codex")
     }
diff --git a/internal/cloud/server-agent-chat.test.ts b/internal/cloud/server-agent-chat.test.ts
index 5167a892..01fa48af 100644
--- a/internal/cloud/server-agent-chat.test.ts
+++ b/internal/cloud/server-agent-chat.test.ts
@@ -422,6 +422,7 @@ test("AgentRun adapter filters resource tools and credentials through access cap
           HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID: "D601",
           HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
           HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
+          HWLAB_CODE_AGENT_AGENTRUN_DEEPSEEK_SECRET_NAME: "agentrun-test-provider-deepseek",
           HWLAB_RUNTIME_API_URL: "http://hwlab-cloud-api.hwlab-v02.svc.cluster.local:6667",
           HWLAB_RUNTIME_WEB_URL: "http://hwlab-cloud-web.hwlab-v02.svc.cluster.local:8080",
           HWLAB_RUNTIME_NAMESPACE: "hwlab-v02",
@@ -855,6 +856,7 @@ test("cloud api /v1/agent/chat delegates v0.3 turns to AgentRun v0.1 over adapte
       HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID: "D601",
       HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
       HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
+      HWLAB_CODE_AGENT_AGENTRUN_DEEPSEEK_SECRET_NAME: "agentrun-test-provider-deepseek",
       HWLAB_CODE_AGENT_DEEPSEEK_MODEL: "deepseek-chat",
       HWLAB_KAFKA_DIRECT_PUBLISH_ENABLED: "false",
       HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED: "false",
@@ -1138,6 +1140,7 @@ test("cloud api rejects billing failure before durable AgentRun admission withou
       HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID: "D601",
       HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
       HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
+      HWLAB_CODE_AGENT_AGENTRUN_DEEPSEEK_SECRET_NAME: "agentrun-test-provider-deepseek",
       HWLAB_ENVIRONMENT: "v03",
       HWLAB_GITOPS_PROFILE: "v03",
       HWLAB_USER_BILLING_CODE_AGENT_ENABLED: "1"
@@ -1241,6 +1244,7 @@ test("cloud api preserves typed schema-invalid admission failure without claimin
       HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID: "D601",
       HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
       HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "gpt-pika",
+      HWLAB_CODE_AGENT_AGENTRUN_GPT_PIKA_SECRET_NAME: "agentrun-test-provider-gpt-pika",
       HWLAB_ENVIRONMENT: "v03",
       HWLAB_GITOPS_PROFILE: "v03"
     },
@@ -1447,6 +1451,7 @@ test("cloud api AgentRun adapter reports persistent thread resume when a complet
       HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID: "D601",
       HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
       HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
+      HWLAB_CODE_AGENT_AGENTRUN_DEEPSEEK_SECRET_NAME: "agentrun-test-provider-deepseek",
       HWLAB_ENVIRONMENT: "v02",
       HWLAB_GITOPS_PROFILE: "v02"
     },
@@ -1620,6 +1625,7 @@ test("cloud api AgentRun adapter exposes invalid tool-call attribution through K
       HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID: "D601",
       HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
       HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
+      HWLAB_CODE_AGENT_AGENTRUN_DEEPSEEK_SECRET_NAME: "agentrun-test-provider-deepseek",
       HWLAB_ENVIRONMENT: "v02",
       HWLAB_GITOPS_PROFILE: "v02"
     },
@@ -1826,6 +1832,7 @@ test("cloud api surfaces manager-side evicted-session recovery through Kafka pro
       HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID: "D601",
       HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
       HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
+      HWLAB_CODE_AGENT_AGENTRUN_DEEPSEEK_SECRET_NAME: "agentrun-test-provider-deepseek",
       HWLAB_ENVIRONMENT: "v02",
       HWLAB_GITOPS_PROFILE: "v02"
     },
@@ -1902,7 +1909,7 @@ test("cloud api AgentRun adapter maps minimax-m3 provider profile to AgentRun ba
       assert.equal(body.sessionRef.metadata.agentRunSessionProfile, "minimax-m3");
       assert.equal(body.sessionRef.metadata.agentRunSessionPolicy, "hwlab-session-scoped");
       assert.equal(body.executionPolicy.secretScope.providerCredentials[0].profile, "minimax-m3");
-      assert.equal(body.executionPolicy.secretScope.providerCredentials[0].secretRef.name, "agentrun-v01-provider-minimax-m3");
+      assert.equal(body.executionPolicy.secretScope.providerCredentials[0].secretRef.name, "agentrun-test-provider-minimax-m3");
       assert.equal(body.executionPolicy.secretScope.providerCredentials[0].secretRef.namespace, "agentrun-v01");
       return send({ id: "run_hwlab_minimax_m3", status: "pending", backendProfile: "minimax-m3", sessionRef: body.sessionRef, resourceBundleRef: body.resourceBundleRef });
     }
@@ -1984,6 +1991,7 @@ test("cloud api AgentRun adapter maps minimax-m3 provider profile to AgentRun ba
       HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID: "D601",
       HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT: "0123456789abcdef0123456789abcdef01234567",
       HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE: "deepseek",
+      HWLAB_CODE_AGENT_AGENTRUN_MINIMAX_M3_SECRET_NAME: "agentrun-test-provider-minimax-m3",
       HWLAB_ENVIRONMENT: "v02",
       HWLAB_GITOPS_PROFILE: "v02"
     },