diff --git a/tests/runner-e2e/chat-catalog-domains/external-company-secret-question.test.ts b/tests/runner-e2e/chat-catalog-domains/external-company-secret-question.test.ts
index ca254e47a8c..5955d94ab75 100644
--- a/tests/runner-e2e/chat-catalog-domains/external-company-secret-question.test.ts
+++ b/tests/runner-e2e/chat-catalog-domains/external-company-secret-question.test.ts
@@ -78,3 +78,11 @@ it.each(["value","mixed","owner","source","field","schema","initial","help solic
  if(fault==="help solicitation")q.helpText="Also provide the key value.";
  expect(companySecretQuestionHandoff(row,binding)).toBeUndefined();
 });
+it("rejects a second secret-value question in rendered environment-name guidance",()=>{
+ const row=environmentQuestion();row.payload.questionSet!.questions[0]!.helpText="What is the deployment key value?";
+ expect(companySecretQuestionHandoff(row,binding)).toBeUndefined();
+});
+it.each(["Enter the deployment key in the secure Settings Secrets form.","You should not paste the key value into chat."])("keeps safe environment-name guidance: %s",helpText=>{
+ const row=environmentQuestion();row.payload.questionSet!.questions[0]!.helpText=helpText;
+ expect(companySecretQuestionHandoff(row,binding)).toMatchObject({environmentName:"DEPLOYMENT_API_KEY"});
+});
diff --git a/tests/runner-e2e/chat-catalog-domains/external-company-secret.ts b/tests/runner-e2e/chat-catalog-domains/external-company-secret.ts
index 0149529b033..b9daadf5872 100644
--- a/tests/runner-e2e/chat-catalog-domains/external-company-secret.ts
+++ b/tests/runner-e2e/chat-catalog-domains/external-company-secret.ts
@@ -47,8 +47,11 @@ export function companySecretQuestionHandoff(value:unknown,b:SecretQuestionBindi
   ||solicitsChatCredential([text,...q.options!.map(o=>`${o.label} ${o.description??""}`)].join("\n")))return;
  if(q.answerMode==="text"){
   const prompt=q.prompt.replace(/\(Do not include the key value\.\)/gi,"").trim();
-  const instructions=[qs.title,qs.description,q.header,q.helpText,qs.submitLabel].filter(Boolean).join("\n").replace(/\b(?:do not|don.t|never)\s+(?:paste|send|share|provide|enter|include)[^.!?\n]*/gi,"");
-  if(/\b(?:paste|send|share|provide|enter|include|supply|type)\b.{0,70}\b(?:key|credential|token)\b/i.test(instructions)||!/^(?:After saving [^?]+,\s*)?(?:what|which) environment variable name should Morgan (?:receive|use)\?$/i.test(prompt)
+  const guidance=[qs.title,qs.description,q.header,q.helpText,qs.submitLabel].filter(Boolean).join("\n");
+  const instructions=guidance.replace(/\b(?:(?:do|should|must|can|could|will|would)\s+not|don.t|never)\s+(?:paste|send|share|provide|enter|include)[^.!?\n]*/gi,"");
+  const unsafeInstructions=instructions.split(/[.!;\n]+/).some(clause=>/\b(?:paste|send|share|provide|enter|include|supply|type)\b.{0,70}\b(?:key|credential|token)\b/i.test(clause)
+   &&!/\b(?:in|into|on|via|through)\b.{0,45}\b(?:settings|secrets|secure (?:form|page|field))\b/i.test(clause));
+  if(guidance.includes("?")||unsafeInstructions||!/^(?:After saving [^?]+,\s*)?(?:what|which) environment variable name should Morgan (?:receive|use)\?$/i.test(prompt)
    || /\b(?:CEO|Riley|Jordan|another agent|all agents|every agent)\b/i.test(text))return;
   const answer=row.result?.answers[0];
   if(status==="answered"&&(row.result?.answers.length!==1||answer?.questionId!==q.id||answer.optionIds.length!==0||answer.otherText!=="DEPLOYMENT_API_KEY"))return;