diff --git a/config/agentrun.yaml b/config/agentrun.yaml
index c515ce8b..6cf891be 100644
--- a/config/agentrun.yaml
+++ b/config/agentrun.yaml
@@ -270,13 +270,6 @@ controlPlane:
             namespace: agentrun-v02
             name: agentrun-v02-api-key
             key: HWLAB_API_KEY
-        - id: runner-api-key-legacy-name
-          sourceRef: hwlab/nc01-v03-admin.env
-          sourceKey: HWLAB_API_KEY
-          targetRef:
-            namespace: agentrun-v02
-            name: agentrun-v01-api-key
-            key: HWLAB_API_KEY
         - id: provider-codex-auth-json
           sourceMode: file
           sourceRef: /root/.codex/auth.json
diff --git a/scripts/src/agentrun-manifests.ts b/scripts/src/agentrun-manifests.ts
index fab3a575..742bca3d 100644
--- a/scripts/src/agentrun-manifests.ts
+++ b/scripts/src/agentrun-manifests.ts
@@ -706,6 +706,8 @@ function managerEnv(spec: AgentRunLaneSpec, sourceCommit: string, imageRef: stri
     { name: "AGENTRUN_RUNNER_IMAGE", value: imageRef },
     { name: "AGENTRUN_RUNNER_SERVICE_ACCOUNT", value: spec.deployment.runner.serviceAccount },
     { name: "AGENTRUN_RUNNER_JOB_NAME_PREFIX", value: spec.deployment.runner.jobNamePrefix },
+    { name: "AGENTRUN_RUNNER_API_KEY_SECRET_NAME", value: spec.deployment.runner.apiKeySecretRef.name },
+    { name: "AGENTRUN_RUNNER_API_KEY_SECRET_KEY", value: spec.deployment.runner.apiKeySecretRef.key },
     { name: "AGENTRUN_RUNNER_IDLE_TIMEOUT_MS", value: String(spec.deployment.runner.idleTimeoutMs) },
     { name: "AGENTRUN_BACKEND_RETRY_MAX_ATTEMPTS", value: String(spec.deployment.runner.backendRetry.maxAttempts) },
     { name: "AGENTRUN_BACKEND_RETRY_INITIAL_BACKOFF_MS", value: String(spec.deployment.runner.backendRetry.initialBackoffMs) },
diff --git a/scripts/src/agentrun.test.ts b/scripts/src/agentrun.test.ts
index bf97e1c9..f01a17cf 100644
--- a/scripts/src/agentrun.test.ts
+++ b/scripts/src/agentrun.test.ts
@@ -1,6 +1,8 @@
 import { readFileSync, rmSync } from "node:fs";
 import { describe, expect, test } from "bun:test";
 import { parseAgentRunClientConfigYaml, resolveAgentRunAuth, runAgentRunCommand, stripAgentRunResourceWrapperArgs } from "./agentrun";
+import { resolveAgentRunLaneTarget } from "./agentrun-lanes";
+import { placeholderAgentRunImage, renderAgentRunGitopsFiles } from "./agentrun-manifests";
 
 const agentRunClientYaml = [
   "manager:",
@@ -162,3 +164,19 @@ describe("AgentRun default transport contract", () => {
     }
   });
 });
+
+describe("AgentRun runner API key SecretRef", () => {
+  test("renders manager runtime authority from the YAML runner SecretRef", () => {
+    const { spec } = resolveAgentRunLaneTarget({ node: "NC01", lane: "nc01-v02" });
+    const files = renderAgentRunGitopsFiles(spec, { sourceCommit: "a".repeat(40), image: placeholderAgentRunImage(spec, "a".repeat(40)) });
+    const managerFile = files.find((file) => file.path.endsWith("/mgr.yaml"));
+    expect(managerFile).toBeDefined();
+    const resources = (managerFile?.content ?? "").split(/\n---\n/u).map((document) => Bun.YAML.parse(document) as Record<string, unknown>);
+    const deployment = resources.find((resource) => resource.kind === "Deployment") as { spec?: { template?: { spec?: { containers?: Array<{ env?: Array<{ name?: string; value?: string }> }> } } } } | undefined;
+    const env = deployment?.spec?.template?.spec?.containers?.[0]?.env ?? [];
+    const values = new Map(env.map((item) => [item.name, item.value]));
+    expect(values.get("AGENTRUN_RUNNER_API_KEY_SECRET_NAME")).toBe(spec.deployment.runner.apiKeySecretRef.name);
+    expect(values.get("AGENTRUN_RUNNER_API_KEY_SECRET_KEY")).toBe(spec.deployment.runner.apiKeySecretRef.key);
+    expect(spec.secrets.some((secret) => secret.targetRef.name === "agentrun-v01-api-key")).toBe(false);
+  });
+});