diff --git a/.github/workflows/firewall-issue-dispatcher.lock.yml b/.github/workflows/firewall-issue-dispatcher.lock.yml
index b9d1c8957..979cf1268 100644
--- a/.github/workflows/firewall-issue-dispatcher.lock.yml
+++ b/.github/workflows/firewall-issue-dispatcher.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"81766783c173bbddf31c7643d72fde46f8c538133809457141859020e819ad0a","body_hash":"dd08146a50a7229b258338ea0f09f8de9f14acabb5a1cf72952632f9ca134108","compiler_version":"v0.87.4","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.80"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"2053f54e1d69fb0c8796135d8990ec71503879577760830165154c19ac6ffa33","body_hash":"62a42b8290306d82caf09fed2c285324a3100bfb1f61800f9ece65ba4d6a8de8","compiler_version":"v0.87.4","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.80"}}
 # gh-aw-manifest: {"version":1,"secrets":["GH_AW_CROSS_REPO_PAT","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"ea4b911d44a5336c74325a122a5fd9110b45ff06","version":"v0.87.4"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.28.4","digest":"sha256:8f18587981eff7e6291784200a88a7191d23bfd8f5723db848c640d6b4e88e46","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.28.4@sha256:8f18587981eff7e6291784200a88a7191d23bfd8f5723db848c640d6b4e88e46"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.4","digest":"sha256:64e668297d1b9d83ee102626e104c054ac2cf5cfd7225bf6e144f86962229882","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.28.4@sha256:64e668297d1b9d83ee102626e104c054ac2cf5cfd7225bf6e144f86962229882"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.28.4","digest":"sha256:35953d0beac18f642aa0bc98bb726a85288539b1fc630c16e94da33300058258","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.28.4@sha256:35953d0beac18f642aa0bc98bb726a85288539b1fc630c16e94da33300058258"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.10","digest":"sha256:08bb5fa417aed94b40a14e2b7b3ae457531a5f22b143a32fe58317139d9b8f42","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.10@sha256:08bb5fa417aed94b40a14e2b7b3ae457531a5f22b143a32fe58317139d9b8f42"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.10.0","digest":"sha256:097512ddf58af80a620c177ae9cad93448f9a2a55c70ee8fde5cec6714522a8c","pinned_image":"ghcr.io/github/github-mcp-server:v1.10.0@sha256:097512ddf58af80a620c177ae9cad93448f9a2a55c70ee8fde5cec6714522a8c"}],"mcp_servers":[{"name":"github","tools":["get_commit","get_file_contents","get_latest_release","get_me","get_pull_request","get_pull_request_comments","get_pull_request_diff","get_pull_request_files","get_pull_request_review_comments","get_pull_request_reviews","get_pull_request_status","get_release_by_tag","get_tag","issue_read","list_branches","list_commits","list_issue_types","list_issues","list_pull_requests","list_releases","list_starred_repositories","list_tags","pull_request_read","search_code","search_issues","search_pull_requests","search_repositories"]},{"name":"safeoutputs","tools":["add_comment","create_issue","missing_data","missing_tool","noop"]}]}
 # This file was automatically generated by gh-aw (v0.87.4). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
diff --git a/.github/workflows/secret-digger-codex.lock.yml b/.github/workflows/secret-digger-codex.lock.yml
index 13521248c..038cef813 100644
--- a/.github/workflows/secret-digger-codex.lock.yml
+++ b/.github/workflows/secret-digger-codex.lock.yml
@@ -1634,7 +1634,6 @@ jobs:
           base_url = "http://172.30.0.30:10000"
           api_base = "http://172.30.0.30:10000"
           wss_base = "ws://172.30.0.30:10000"
-          env_key = "OPENAI_API_KEY"
           supports_websockets = false
           GH_AW_CODEX_DETECTION_CONFIG_5face6846efecd71_EOF
           cp "${RUNNER_TEMP}/gh-aw/mcp-config/config.toml" "/tmp/gh-aw/mcp-config/config.toml"
diff --git a/.github/workflows/smoke-cloud-hypervisor-codex.lock.yml b/.github/workflows/smoke-cloud-hypervisor-codex.lock.yml
index b52af9114..e94aee7ed 100644
--- a/.github/workflows/smoke-cloud-hypervisor-codex.lock.yml
+++ b/.github/workflows/smoke-cloud-hypervisor-codex.lock.yml
@@ -922,7 +922,6 @@ jobs:
           [model_providers.openai-proxy]
           name = "OpenAI AWF proxy"
           base_url = "http://172.30.0.30:10000"
-          env_key = "OPENAI_API_KEY"
           supports_websockets = false
           [shell_environment_policy]
           inherit = "core"
diff --git a/.github/workflows/smoke-docker-sbx-codex.lock.yml b/.github/workflows/smoke-docker-sbx-codex.lock.yml
index 5db381b8c..94674cfeb 100644
--- a/.github/workflows/smoke-docker-sbx-codex.lock.yml
+++ b/.github/workflows/smoke-docker-sbx-codex.lock.yml
@@ -946,7 +946,6 @@ jobs:
           [model_providers.openai-proxy]
           name = "OpenAI AWF proxy"
           base_url = "http://172.30.0.30:10000"
-          env_key = "OPENAI_API_KEY"
           supports_websockets = false
           [shell_environment_policy]
           inherit = "core"
diff --git a/.github/workflows/smoke-gvisor-codex.lock.yml b/.github/workflows/smoke-gvisor-codex.lock.yml
index 7459af7a1..fe3b17cbc 100644
--- a/.github/workflows/smoke-gvisor-codex.lock.yml
+++ b/.github/workflows/smoke-gvisor-codex.lock.yml
@@ -916,7 +916,6 @@ jobs:
           [model_providers.openai-proxy]
           name = "OpenAI AWF proxy"
           base_url = "http://172.30.0.30:10000"
-          env_key = "OPENAI_API_KEY"
           supports_websockets = false
           [shell_environment_policy]
           inherit = "core"
diff --git a/scripts/ci/postprocess-smoke-workflows.ts b/scripts/ci/postprocess-smoke-workflows.ts
index f0d70f5fa..3790c9f55 100644
--- a/scripts/ci/postprocess-smoke-workflows.ts
+++ b/scripts/ci/postprocess-smoke-workflows.ts
@@ -21,6 +21,9 @@ const repoRoot = path.resolve(__dirname, '../..');
 // using trigger terms.
 const codexWorkflowPaths = [
   path.join(repoRoot, '.github/workflows/smoke-codex.lock.yml'),
+  path.join(repoRoot, '.github/workflows/smoke-gvisor-codex.lock.yml'),
+  path.join(repoRoot, '.github/workflows/smoke-docker-sbx-codex.lock.yml'),
+  path.join(repoRoot, '.github/workflows/smoke-cloud-hypervisor-codex.lock.yml'),
   path.join(repoRoot, '.github/workflows/secret-digger-codex.lock.yml'),
 ];