diff --git a/tests/runner-e2e/catalog.test.ts b/tests/runner-e2e/catalog.test.ts
index ccf44672e71..4d26f0af215 100644
--- a/tests/runner-e2e/catalog.test.ts
+++ b/tests/runner-e2e/catalog.test.ts
@@ -64,6 +64,31 @@ describe("runner E2E catalog", () => {
     }
   });
 
+  it("binds native Codex automation auth to the encrypted OpenAI secret", () => {
+    const execution = runnerMatrix.find(
+      (candidate) => candidate.id === "runner-codex.local.message-marker",
+    );
+    expect(execution).toBeDefined();
+    const secretRef = {
+      type: "secret_ref" as const,
+      secretId: "22222222-2222-4222-8222-222222222222",
+      version: "latest" as const,
+    };
+    const agent = execution!.profile.buildAgent({
+      environmentId: "11111111-1111-4111-8111-111111111111",
+      environmentFixtureId: "local",
+      workspacePath: "/tmp/runner-e2e-workspace",
+      secretRefs: { OPENAI_API_KEY: secretRef },
+      executionId: execution!.id,
+    });
+    expect(agent.adapterConfig).toMatchObject({
+      env: {
+        OPENAI_API_KEY: secretRef,
+        CODEX_API_KEY: secretRef,
+      },
+    });
+  });
+
   it("gives legacy planning agents a direct bounded API recipe", () => {
     const task = runnerTasks.find(
       (candidate) => candidate.id === "plan-revise-accept",
diff --git a/tests/runner-e2e/catalog.ts b/tests/runner-e2e/catalog.ts
index ea2a1be1d89..9bef1fd12b1 100644
--- a/tests/runner-e2e/catalog.ts
+++ b/tests/runner-e2e/catalog.ts
@@ -143,6 +143,7 @@ function nativeProfile(input: {
       provider: input.provider,
     },
     buildAgent(buildInput) {
+      const credentialRef = requiredSecret(buildInput, input.credential);
       const permissionConfig =
         input.provider === "codex"
           ? { codexPermissionMode: "never" }
@@ -156,7 +157,13 @@ function nativeProfile(input: {
         idleTimeoutMs: 300_000,
         ...permissionConfig,
         env: {
-          [input.credential]: requiredSecret(buildInput, input.credential),
+          [input.credential]: credentialRef,
+          // Codex's supported automation credential is CODEX_API_KEY. Keep
+          // OPENAI_API_KEY as the operator-facing fixture secret name and bind
+          // the same encrypted reference to the runtime-specific alias.
+          ...(input.provider === "codex"
+            ? { CODEX_API_KEY: credentialRef }
+            : {}),
         },
       });
     },