diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 2ec520525..68bbfdef1 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -29,6 +29,12 @@ jobs:
           # The integration suite boots a Postgres testcontainer and points
           # Prisma at it via DATABASE_URL set inside `tests/integration/setup.ts`.
           # These env vars satisfy code paths that read them at module load.
-          API_TOKEN_HMAC_KEY: integration-tests-do-not-use-in-prod
-          ENCRYPTION_KEY: 0000000000000000000000000000000000000000000000000000000000000000
-          SESSION_SECRET: integration-tests
+          #
+          # ENCRYPTION_KEY MUST be quoted: YAML 1.2 parses an unquoted run of
+          # zeros as the integer 0, which then arrives in `process.env` as the
+          # string "0" — failing crypto's hex/base64 length check and breaking
+          # the backups + integration-status suites for 50+ runs (regression
+          # since v1.4.13). Quoting forces a literal scalar.
+          API_TOKEN_HMAC_KEY: "integration-tests-do-not-use-in-prod"
+          ENCRYPTION_KEY: "0000000000000000000000000000000000000000000000000000000000000000"
+          SESSION_SECRET: "integration-tests"
diff --git a/e2e/onboarding-flicker.spec.ts b/e2e/onboarding-flicker.spec.ts
index 888aa0ded..b3fef3e94 100644
--- a/e2e/onboarding-flicker.spec.ts
+++ b/e2e/onboarding-flicker.spec.ts
@@ -46,6 +46,7 @@ test.describe("dashboard onboarding card flicker guard", () => {
             gender: "MALE",
             timezone: "Europe/Berlin",
             onboardingCompletedAt: "2025-01-01T00:00:00.000Z",
+            onboardingTourCompleted: true,
             gravatarUrl: null,
             glucoseUnit: "mg/dL",
           },
@@ -138,6 +139,11 @@ test.describe("dashboard onboarding card flicker guard", () => {
             gender: null,
             timezone: "Europe/Berlin",
             onboardingCompletedAt: null,
+            // Suppress the spotlight tour overlay during this spec so
+            // the onboarding-card visibility probe is not occluded by
+            // the tour's z-200 dialog. The tour itself is exercised by
+            // a dedicated spec — not in scope here.
+            onboardingTourCompleted: true,
             gravatarUrl: null,
             glucoseUnit: "mg/dL",
           },
diff --git a/e2e/setup/global-setup.ts b/e2e/setup/global-setup.ts
index 84276af4d..0d6daf02a 100644
--- a/e2e/setup/global-setup.ts
+++ b/e2e/setup/global-setup.ts
@@ -89,7 +89,14 @@ export default async function globalSetup(config: FullConfig): Promise<void> {
     // SET clause clears any leftover Codex / insights state from a
     // previous run so the "Settings → AI" spec sees the disconnected
     // baseline; we also stamp `onboarding_completed_at` so the auth
-    // shell does not bounce the user to /onboarding.
+    // shell does not bounce the user to /onboarding, AND set
+    // `onboarding_tour_completed = true` so the spotlight tour does
+    // NOT auto-launch on the dashboard. Without that flag the tour
+    // mounts a full-viewport `role="dialog"` overlay with `z-index:200`
+    // that intercepts every pointer event — every authenticated spec
+    // that tries to click a header / sidebar / quick-add button times
+    // out (50+ failed CI runs since v1.4.13). Specs that need the
+    // tour can opt back in by mocking `/api/auth/me`.
     await pool.query(
       `INSERT INTO users
         (id, username, email, password_hash, role,
@@ -97,13 +104,15 @@ export default async function globalSetup(config: FullConfig): Promise<void> {
          height_cm, date_of_birth, gender,
          codex_connection_status,
          insights_privacy_mode,
-         onboarding_completed_at)
+         onboarding_completed_at,
+         onboarding_tour_completed)
        VALUES ($1, $2, $3, $4, $5,
                $6, $6,
                180, $7, 'MALE',
                'disconnected',
                'aggregated',
-               $6)
+               $6,
+               true)
        ON CONFLICT (username) DO UPDATE SET
          email = EXCLUDED.email,
          password_hash = EXCLUDED.password_hash,
@@ -119,7 +128,8 @@ export default async function globalSetup(config: FullConfig): Promise<void> {
          codex_connection_status = 'disconnected',
          insights_cached_at = NULL,
          insights_cached_text = NULL,
-         onboarding_completed_at = EXCLUDED.onboarding_completed_at`,
+         onboarding_completed_at = EXCLUDED.onboarding_completed_at,
+         onboarding_tour_completed = EXCLUDED.onboarding_tour_completed`,
       [
         cuid(),
         E2E_USER.username,