diff --git a/.github/workflows/nightly-e2e.yaml b/.github/workflows/nightly-e2e.yaml
index 16dc2edde60..f6195f4d09d 100644
--- a/.github/workflows/nightly-e2e.yaml
+++ b/.github/workflows/nightly-e2e.yaml
@@ -187,6 +187,7 @@ jobs:
           NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
           NEMOCLAW_NON_INTERACTIVE: "1"
           NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
+          NEMOCLAW_POLICY_TIER: "open"
           NEMOCLAW_SANDBOX_NAME: "e2e-msg-provider"
           NEMOCLAW_RECREATE_SANDBOX: "1"
           GITHUB_TOKEN: ${{ github.token }}
diff --git a/test/e2e/test-sandbox-survival.sh b/test/e2e/test-sandbox-survival.sh
index b84473faf32..d84a68910cc 100755
--- a/test/e2e/test-sandbox-survival.sh
+++ b/test/e2e/test-sandbox-survival.sh
@@ -552,13 +552,25 @@ fi
 pass "SSH config available after restart"
 
 # 8a: Raw SSH connectivity — the #888/#1086 handshake test
-if ssh "${SSH_OPTS[@]}" "$SSH_TARGET" "echo alive" >/dev/null 2>&1; then
-  pass "SSH into sandbox works after restart (no handshake failure — #888/#1086)"
+# The sandbox SSH agent may take a few seconds to become reachable after
+# the gateway reports healthy (especially with newer OpenClaw versions that
+# do more startup work). Retry up to 30 seconds before declaring failure.
+SSH_OK=0
+for ssh_attempt in $(seq 1 6); do
+  if ssh "${SSH_OPTS[@]}" "$SSH_TARGET" "echo alive" >/dev/null 2>&1; then
+    SSH_OK=1
+    break
+  fi
+  [ "$ssh_attempt" -lt 6 ] && sleep 5
+done
+
+if [ "$SSH_OK" -eq 1 ]; then
+  pass "SSH into sandbox works after restart (attempt $ssh_attempt, no handshake failure — #888/#1086)"
 else
   fail "SSH into sandbox FAILED after restart — handshake verification likely failed (#888/#1086)"
   info "This is the core bug: gateway regenerated secrets, sandbox has stale ones"
-  cleanup_ssh
-  # Still try to get logs for diagnosis
+  # Do NOT call cleanup_ssh here — subsequent phases need the config file
+  # to attempt marker reads and produce meaningful diagnostics.
   nemoclaw "$SANDBOX_NAME" logs 2>&1 | grep -i "handshake" | head -5 || true
 fi