diff --git a/test/start-additional-kas/action.yaml b/test/start-additional-kas/action.yaml
index 74fcdb1e9c..b368955457 100644
--- a/test/start-additional-kas/action.yaml
+++ b/test/start-additional-kas/action.yaml
@@ -145,6 +145,13 @@ runs:
         LOG_TYPE: ${{ inputs.log-type }}
       with:
         run: |
+          # If PQC is requested but key files were not generated, the platform
+          # version likely does not support PQC key types. Disable PQC to avoid
+          # referencing missing key files in the config.
+          if [ "${PQC_ENABLED}" == "true" ] && [ ! -f kas-xwing-private.pem ]; then
+            echo "::warning::PQC enabled but key files not found (platform version may not support PQC). Disabling PQC key configuration for KAS ${KAS_NAME}."
+            export PQC_ENABLED="false"
+          fi
           yq e '
             (.server.port = env(KAS_PORT))
             | (.mode = ["kas"])
diff --git a/test/start-up-with-containers/action.yaml b/test/start-up-with-containers/action.yaml
index e9186da00d..0f1fe3cff4 100644
--- a/test/start-up-with-containers/action.yaml
+++ b/test/start-up-with-containers/action.yaml
@@ -192,7 +192,13 @@ runs:
         allowed_algorithms=(ec:secp256r1 rsa:2048)
         if echo $PLATFORM_VERSION | awk -F. '{ if ($1 > 0 || ($1 == 0 && $2 > 7) || ($1 == 0 && $2 == 7 && $3 >= 1)) exit 0; else exit 1; }'; then
           # For versions 0.7.1 and later, we allow rsa:4096 ec:secp384r1 ec:secp521r1
-          allowed_algorithms+=(rsa:4096 ec:secp384r1 ec:secp521r1 hpqt:xwing hpqt:secp256r1-mlkem768 hpqt:secp384r1-mlkem1024)
+          allowed_algorithms+=(rsa:4096 ec:secp384r1 ec:secp521r1)
+          # Only allow PQC algorithms if the platform keygen produced the key files
+          if [ -f kas-xwing-private.pem ]; then
+            allowed_algorithms+=(hpqt:xwing hpqt:secp256r1-mlkem768 hpqt:secp384r1-mlkem1024)
+          else
+            echo "::notice::PQC key files not found; hpqt algorithms will not be allowed for extra keys"
+          fi
         fi
         keyring='[{"kid":"ec1","alg":"ec:secp256r1"},{"kid":"r1","alg":"rsa:2048"}]'
         keys='[{"kid":"e1","alg":"ec:secp256r1","private":"kas-ec-private.pem","cert":"kas-ec-cert.pem"},{"kid":"ec1","alg":"ec:secp256r1","private":"kas-ec-private.pem","cert":"kas-ec-cert.pem"},{"kid":"r1","alg":"rsa:2048","private":"kas-private.pem","cert":"kas-cert.pem"}]'
@@ -245,6 +251,10 @@ runs:
       shell: bash
       if: ${{ inputs.pqc-enabled == 'true' }}
       run: |
+        if [ ! -f kas-xwing-private.pem ]; then
+          echo "::warning::PQC enabled but key files not found (platform version may not support PQC). Skipping PQC key configuration."
+          exit 0
+        fi
         yq e '
           (.services.kas.preview.hybrid_tdf_enabled = true)
           | (.services.kas.keyring += [{"kid":"x1","alg":"hpqt:xwing"},{"kid":"h1","alg":"hpqt:secp256r1-mlkem768"},{"kid":"h2","alg":"hpqt:secp384r1-mlkem1024"}])