diff --git a/src/__tests__/ai-egress-capability-guard.test.ts b/src/__tests__/ai-egress-capability-guard.test.ts
index 123c56808..b163f5f9d 100644
--- a/src/__tests__/ai-egress-capability-guard.test.ts
+++ b/src/__tests__/ai-egress-capability-guard.test.ts
@@ -147,6 +147,11 @@ const EGRESS_SITES: Record<string, EgressSite> = {
     recheck: false,
     reason: "The offline evaluation harness; never on a request or job path.",
   },
+  "lib/ai/coach/eval/run-case.ts": {
+    recheck: false,
+    reason:
+      "The offline evaluation harness's live scenario run, called only by judge.ts; never on a request or job path.",
+  },
 };
 
 describe("AI egress call sites", () => {
diff --git a/src/__tests__/compose-env-whitelist-guard.test.ts b/src/__tests__/compose-env-whitelist-guard.test.ts
index ba8cfb12a..79f28af68 100644
--- a/src/__tests__/compose-env-whitelist-guard.test.ts
+++ b/src/__tests__/compose-env-whitelist-guard.test.ts
@@ -131,6 +131,8 @@ const NOT_OPERATOR_CONFIGURABLE: Readonly<Record<string, string>> = {
     "repository secret for the nightly model-graded Coach eval; that workflow runs in CI, never in the app image",
   COACH_EVAL_GENERATOR_MODEL: "CI-only knob for the same nightly eval workflow",
   COACH_EVAL_JUDGE_MODEL: "CI-only knob for the same nightly eval workflow",
+  COACH_EVAL_SCENARIO_REPEATS:
+    "CI-only knob for the same nightly eval workflow",
   HEALTHLOG_MCP_TOKEN:
     "read by the local stdio MCP bridge the operator runs on their own machine; the production image strips tsx so it cannot run there",