diff --git a/packages/paperclip-runner/runner/crates/runner-core/src/codex_provider.rs b/packages/paperclip-runner/runner/crates/runner-core/src/codex_provider.rs
index e98d120278..42bc7fd9c7 100644
--- a/packages/paperclip-runner/runner/crates/runner-core/src/codex_provider.rs
+++ b/packages/paperclip-runner/runner/crates/runner-core/src/codex_provider.rs
@@ -4186,7 +4186,17 @@ done
     #[test]
     fn github_credentials_cross_only_the_bounded_provider_environment() {
         assert_eq!(GITHUB_CREDENTIAL_ENVIRONMENT_KEYS.len(), 95);
+        assert_eq!(
+            GITHUB_CREDENTIAL_ENVIRONMENT_KEYS
+                .iter()
+                .collect::<std::collections::BTreeSet<_>>()
+                .len(),
+            GITHUB_CREDENTIAL_ENVIRONMENT_KEYS.len(),
+            "provider environment keys must be unique",
+        );
         for key in [
+            "ZDOTDIR",
+            "BASH_ENV",
             "PAPERCLIP_RUNNER_NETWORK_ACCESS",
             "PAPERCLIP_RUNNER_NETWORK_ROOTS",
             "PAPERCLIP_GITHUB_AUTH_MODE",
diff --git a/packages/paperclip-runner/runner/crates/runner-core/src/process_supervisor.rs b/packages/paperclip-runner/runner/crates/runner-core/src/process_supervisor.rs
index 4df34e74d4..6e3ebe83ff 100644
--- a/packages/paperclip-runner/runner/crates/runner-core/src/process_supervisor.rs
+++ b/packages/paperclip-runner/runner/crates/runner-core/src/process_supervisor.rs
@@ -41,8 +41,6 @@ pub(crate) const GITHUB_CREDENTIAL_ENVIRONMENT_KEYS: &[&str] = &[
     "GIT_SSH",
     "ZDOTDIR",
     "BASH_ENV",
-    "ZDOTDIR",
-    "BASH_ENV",
     "PAPERCLIP_GITHUB_BROKER_URL",
     "PAPERCLIP_GITHUB_BROKER_TOKEN",
     "PAPERCLIP_GITHUB_LAUNCHER_DIR",
diff --git a/tests/e2e/chat-adapters-ui.spec.ts b/tests/e2e/chat-adapters-ui.spec.ts
index 77b403e06e..11bfec92a6 100644
--- a/tests/e2e/chat-adapters-ui.spec.ts
+++ b/tests/e2e/chat-adapters-ui.spec.ts
@@ -1531,7 +1531,8 @@ test.describe.serial("native chat adapter UI", () => {
       ).toBeVisible();
       await expectSetupRail(page);
       await selectMaya(page);
-      expect(mock.createdWithAgentId).toBe(seed.agentId);
+      // The selection schedules a request; clicking alone does not await it.
+      await expect.poll(() => mock.createdWithAgentId).toBe(seed.agentId);
       expect(mock.createdWithAgentId).not.toBe(seed.otherAgentId);
       await expect(
         page.getByRole("button", { name: "Choose an active agent" }),