diff --git a/packages/cli/src/commands/workflow.ts b/packages/cli/src/commands/workflow.ts
index 89dd5911e4..92a93c70ac 100644
--- a/packages/cli/src/commands/workflow.ts
+++ b/packages/cli/src/commands/workflow.ts
@@ -30,6 +30,7 @@ import {
 } from '@archon/core/operations/workflow-operations';
 import * as conversationDb from '@archon/core/db/conversations';
 import * as codebaseDb from '@archon/core/db/codebases';
+import * as envVarDb from '@archon/core/db/env-vars';
 import * as isolationDb from '@archon/core/db/isolation-environments';
 import * as messageDb from '@archon/core/db/messages';
 import * as workflowDb from '@archon/core/db/workflows';
@@ -591,6 +592,30 @@ export async function workflowRunCommand(
         renderWorkflowEvent(event, verbose ?? false);
       });
 
+  // Inject codebase env vars into process.env so bash nodes inherit them.
+  // AI nodes already receive them via the Claude SDK client, but bash nodes
+  // are spawned directly and only see process.env.
+  // Snapshot previous values so we can restore after execution.
+  const previousEnvForInjectedKeys: Record<string, string | undefined> = {};
+  if (codebase) {
+    try {
+      const codebaseEnvVars = await envVarDb.getCodebaseEnvVars(codebase.id);
+      const injectedCount = Object.keys(codebaseEnvVars).length;
+      if (injectedCount > 0) {
+        for (const key of Object.keys(codebaseEnvVars)) {
+          previousEnvForInjectedKeys[key] = process.env[key];
+        }
+        Object.assign(process.env, codebaseEnvVars);
+        getLog().info({ codebaseId: codebase.id, injectedCount }, 'cli.codebase_env_vars_injected');
+      }
+    } catch (error) {
+      getLog().warn(
+        { err: error as Error, codebaseId: codebase.id },
+        'cli.codebase_env_vars_load_failed'
+      );
+    }
+  }
+
   // Execute workflow with workingCwd (may be worktree path)
   let result: Awaited<ReturnType<typeof executeWorkflow>>;
   try {
@@ -605,6 +630,14 @@ export async function workflowRunCommand(
       codebase?.id
     );
   } finally {
+    // Restore process.env to its pre-injection state
+    for (const [key, previousValue] of Object.entries(previousEnvForInjectedKeys)) {
+      if (previousValue === undefined) {
+        Reflect.deleteProperty(process.env, key);
+      } else {
+        process.env[key] = previousValue;
+      }
+    }
     unsubscribe?.();
   }