diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 37afd77afd..7561ee4a57 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -1,7 +1,8 @@
 name: E2E (real DeepSeek API)
 
 # Real-API end-to-end suite (`pnpm run test:e2e`). Unlike ci.yml this job
-# consumes the DEEPSEEK_API_KEY secret and hits the external API at
+# consumes the DEEPSEEK_API_KEY_EXTERNAL secret (mapped to the env var
+# DEEPSEEK_API_KEY the tests read) and hits the external API at
 # https://api.deepseek.com (DEEPSEEK_BASE_URL is pinned to it explicitly so a
 # stray repo-root .env can't redirect the run).
 #
@@ -67,12 +68,14 @@ jobs:
       # excludes keyless PRs), so the secret MUST be present — fail loudly if not.
       - name: Preflight (require DEEPSEEK_API_KEY)
         env:
-          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+          # Repo secret DEEPSEEK_API_KEY_EXTERNAL holds the external-API key;
+          # the tests read process.env.DEEPSEEK_API_KEY, so map it across here.
+          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY_EXTERNAL }}
         run: |
           set -euo pipefail
           if [ -z "${DEEPSEEK_API_KEY:-}" ]; then
-            echo "::error::DEEPSEEK_API_KEY is not set. The e2e suite would self-skip and"
-            echo "::error::report a false green. Configure the repo secret DEEPSEEK_API_KEY."
+            echo "::error::DEEPSEEK_API_KEY is empty. The e2e suite would self-skip and"
+            echo "::error::report a false green. Configure the repo secret DEEPSEEK_API_KEY_EXTERNAL."
             exit 1
           fi
           echo "DEEPSEEK_API_KEY present."
@@ -84,6 +87,6 @@ jobs:
       # this step (and preflight) only — never exposed to checkout/setup/install.
       - name: E2E tests (real DeepSeek API)
         env:
-          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY_EXTERNAL }}
           DEEPSEEK_BASE_URL: https://api.deepseek.com
         run: pnpm run test:e2e