diff --git a/.github/workflows/deploy-Dataspace.yml b/.github/workflows/deploy-Dataspace.yml
index 59e773d1..d58d89b6 100644
--- a/.github/workflows/deploy-Dataspace.yml
+++ b/.github/workflows/deploy-Dataspace.yml
@@ -236,12 +236,16 @@ jobs:
     with:
       suite: functional
       only_provider: true
+      api_base_url: https://dev.api.civicdataspace.in
     secrets:
       HOME_URL_DEV: ${{ secrets.HOME_URL_DEV }}
       TEST_EMAIL_1: ${{ secrets.TEST_EMAIL_1 }}
       TEST_PASSWORD_1: ${{ secrets.TEST_PASSWORD_1 }}
       TEST_EMAIL_2: ${{ secrets.TEST_EMAIL_2 }}
       TEST_PASSWORD_2: ${{ secrets.TEST_PASSWORD_2 }}
+      # org_add_permission needs a token to check canAdd; without this every
+      # org-create test skips on both workers and the report is hollow.
+      KEYCLOAK_CLIENT_SECRET: ${{ secrets.KEYCLOAK_CLIENT_SECRET }}
 
   # Only once the tests pass does this release become the thing a future
   # rollback would target -- on prod too, which used to be marked
diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml
index 06ed599e..f68c08a0 100644
--- a/.github/workflows/pr-gate.yml
+++ b/.github/workflows/pr-gate.yml
@@ -35,9 +35,13 @@ jobs:
     with:
       suite: full
       only_provider: true
+      api_base_url: https://dev.api.civicdataspace.in
     secrets:
       HOME_URL_DEV: ${{ secrets.HOME_URL_DEV }}
       TEST_EMAIL_1: ${{ secrets.TEST_EMAIL_1 }}
       TEST_PASSWORD_1: ${{ secrets.TEST_PASSWORD_1 }}
       TEST_EMAIL_2: ${{ secrets.TEST_EMAIL_2 }}
       TEST_PASSWORD_2: ${{ secrets.TEST_PASSWORD_2 }}
+      # org_add_permission needs a token to check canAdd; without this every
+      # org-create test skips on both workers and the report is hollow.
+      KEYCLOAK_CLIENT_SECRET: ${{ secrets.KEYCLOAK_CLIENT_SECRET }}