diff --git a/scripts/src/platform-infra-sub2api-codex-sentinel.ts b/scripts/src/platform-infra-sub2api-codex-sentinel.ts
index 4a5bf527..da9fb33a 100644
--- a/scripts/src/platform-infra-sub2api-codex-sentinel.ts
+++ b/scripts/src/platform-infra-sub2api-codex-sentinel.ts
@@ -205,8 +205,8 @@ export function readCodexPoolSentinelConfig(value: unknown, defaults: CodexPoolS
     cronJobName: readRequiredDnsName(valueAt(value, "cronJobName"), `${sourcePath}.sentinel.cronJobName`),
     roleName: readRequiredDnsName(valueAt(value, "roleName"), `${sourcePath}.sentinel.roleName`),
     roleBindingName: readRequiredDnsName(valueAt(value, "roleBindingName"), `${sourcePath}.sentinel.roleBindingName`),
-    model: readModelName(valueAt(value, "model"), `${sourcePath}.sentinel.model`, defaults.model),
-    endpoint: "responses",
+    model: readRequiredModelName(valueAt(value, "model"), `${sourcePath}.sentinel.model`),
+    endpoint: readRequiredEndpoint(valueAt(value, "endpoint"), `${sourcePath}.sentinel.endpoint`),
     marker: {
       prefix: readMarkerPrefix(valueAt(marker, "prefix"), `${sourcePath}.sentinel.marker.prefix`, defaults.marker.prefix),
       exact: readBoolean(valueAt(marker, "exact"), `${sourcePath}.sentinel.marker.exact`, defaults.marker.exact),
@@ -2106,20 +2106,30 @@ function readDnsName(value: unknown, key: string, fallback: string): string {
 }
 
 function readRequiredDnsName(value: unknown, key: string): string {
-  if (value === undefined || value === null) throw new Error(`${key} is required`);
-  if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${key} must be a non-empty string`);
-  if (/[\r\n]/u.test(value)) throw new Error(`${key} must not contain newlines`);
-  const text = value.trim();
+  const text = readRequiredString(value, key);
   if (!/^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/u.test(text)) throw new Error(`${key} must be a Kubernetes DNS label`);
   return text;
 }
 
-function readModelName(value: unknown, key: string, fallback: string): string {
-  const text = readString(value, key, fallback);
+function readRequiredModelName(value: unknown, key: string): string {
+  const text = readRequiredString(value, key);
   if (!/^[A-Za-z0-9._:-]+$/u.test(text)) throw new Error(`${key} has an unsupported model name`);
   return text;
 }
 
+function readRequiredEndpoint(value: unknown, key: string): "responses" {
+  const text = readRequiredString(value, key);
+  if (text !== "responses") throw new Error(`${key} must be responses`);
+  return text;
+}
+
+function readRequiredString(value: unknown, key: string): string {
+  if (value === undefined || value === null) throw new Error(`${key} is required`);
+  if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${key} must be a non-empty string`);
+  if (/[\r\n]/u.test(value)) throw new Error(`${key} must not contain newlines`);
+  return value.trim();
+}
+
 function readMarkerPrefix(value: unknown, key: string, fallback: string): string {
   const text = readString(value, key, fallback);
   if (!/^[A-Za-z0-9_-]{2,32}$/u.test(text)) throw new Error(`${key} must be 2-32 chars of letters, digits, _ or -`);