diff --git a/cli/src/lib/local.ts b/cli/src/lib/local.ts
index 875e05a0f51..996192e8d64 100644
--- a/cli/src/lib/local.ts
+++ b/cli/src/lib/local.ts
@@ -855,11 +855,15 @@ export async function startLocalDaemon(
         HOME: process.env.HOME || home,
         PATH: [...extraDirs, basePath].filter(Boolean).join(":"),
       };
-      // Forward optional config env vars the daemon may need
+      // Forward optional config env vars the daemon may need.
+      // `VELLUM_ENVIRONMENT` must be forwarded so the daemon resolves
+      // env-scoped paths (device ID, platform/guardian tokens, XDG
+      // config dir) to the same location as the CLI that spawned it.
       for (const key of [
         "ANTHROPIC_API_KEY",
         "APP_VERSION",
         "BASE_DATA_DIR",
+        "VELLUM_ENVIRONMENT",
         "VELLUM_PLATFORM_URL",
         "QDRANT_HTTP_PORT",
         "QDRANT_URL",
diff --git a/clients/macos/vellum-assistant/App/VellumCli.swift b/clients/macos/vellum-assistant/App/VellumCli.swift
index 318a6415d58..20c90186e87 100644
--- a/clients/macos/vellum-assistant/App/VellumCli.swift
+++ b/clients/macos/vellum-assistant/App/VellumCli.swift
@@ -109,7 +109,12 @@ final class VellumCli: AssistantManagementClient {
 
     /// Environment variable keys forwarded from the host process to CLI
     /// child processes. Centralised so every call site stays in sync.
+    /// `VELLUM_ENVIRONMENT` must be forwarded so the bundled CLI resolves
+    /// env-scoped paths (lockfile, device ID, platform/guardian tokens,
+    /// workspace config) to the same location the desktop app uses. The
+    /// app's Info.plist sets this at build time (see `build.sh:1054`).
     nonisolated private static let forwardedEnvKeys: [String] = [
+        "VELLUM_ENVIRONMENT",
         "VELLUM_PLATFORM_URL",
         "VELLUM_WORKSPACE_DIR",
         "ASSISTANT_GIT_USER_NAME", "ASSISTANT_GIT_USER_EMAIL",