diff --git a/scripts/deployment-boot-smoke.mjs b/scripts/deployment-boot-smoke.mjs
index 66950e5b0..015efc3b1 100644
--- a/scripts/deployment-boot-smoke.mjs
+++ b/scripts/deployment-boot-smoke.mjs
@@ -124,6 +124,8 @@ async function bootSmoke() {
       // fail with real errors, but /api/local-project-id does not.
       SUPABASE_SERVICE_ROLE_KEY: process.env.SUPABASE_SERVICE_ROLE_KEY ?? "placeholder-ci-service-role",
       OPENAI_API_KEY: process.env.OPENAI_API_KEY ?? "placeholder-ci-openai",
+      // instrumentation.ts requireQueryHashSecret() needs a min-16-char value in production.
+      RAG_QUERY_HASH_SECRET: process.env.RAG_QUERY_HASH_SECRET ?? "placeholder-ci-rag-query-hash-secret",
     },
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,